Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe

Overview

General Information

Sample name:SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe
Analysis ID:1476246
MD5:3cb0739401d24b6bc0c65e337e15c104
SHA1:aefca0e1d01e9ffecd8cc2a0c9dc495d6f5fe9d8
SHA256:48053935a1b62d13f2a1301d42a3be930bb4718e8476c32b5050512209fdb3bb
Tags:exe
Infos:

Detection

PrivateLoader
Score:46
Range:0 - 100
Whitelisted:false
Confidence:100%

Compliance

Score:51
Range:0 - 100

Signatures

Multi AV Scanner detection for submitted file
Yara detected PrivateLoader
Contains functionality to infect the boot sector
Found suspicious ZIP file
NDIS Filter Driver detected (likely used to intercept and sniff network traffic)
Potentially malicious time measurement code found
Query firmware table information (likely to detect VMs)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes a notice file (html or txt) to demand a ransom
Writes many files with high entropy
Yara detected QueryWinSAT ClassID
AV process strings found (often used to terminate AV products)
Adds / modifies Windows certificates
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to communicate with device drivers
Contains functionality to create guard pages, often used to hinder reverse engineering and debugging
Contains functionality to dynamically determine API calls
Contains functionality to launch a process as a different user
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates COM task schedule object (often to register a task for autostart)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates or modifies windows services
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Drops certificate files (DER)
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
One or more processes crash
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file does not import any functions
Queries disk information (often used to detect virtual machines)
Queries information about the installed CPU (vendor, model number etc)
Queries keyboard layouts
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sleep loop found (likely to delay execution)
Stores files to the Windows start menu directory
Stores large binary data to the registry
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
query blbeacon for getting browser version

Classification

Process Tree

  • System is w10x64
  • SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe (PID: 6688 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe" MD5: 3CB0739401D24B6BC0C65E337E15C104)
    • SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp (PID: 6740 cmdline: "C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp" /SL5="$10418,1635575,878080,C:\Users\user\Desktop\SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe" MD5: DD40149397C65DB7E46877143552AAC5)
      • BitComet_2.08a_setup.exe (PID: 4180 cmdline: "C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe" /S MD5: 4F45F9BD3CC4739BDC91A4D183C0DC01)
        • BitCometService.exe (PID: 5824 cmdline: "C:\Program Files\BitComet\tools\BitCometService.exe" /reg MD5: AE7FBFF183FF30913EBEB38913E8CFAD)
        • BitComet_stats.exe (PID: 2228 cmdline: "C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe" https://www.bitcomet.com/client/install-stats/?l=en_us&file=BitComet_2.08a_setup.exe&p=x64 MD5: EDB96675541D0275C42096B64D794D3B)
      • saBSI.exe (PID: 6316 cmdline: "C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exe" /affid 91088 PaidDistribution=true CountryCode=US MD5: 143255618462A577DE27286A272584E1)
        • installer.exe (PID: 8024 cmdline: "C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\\installer.exe" /setOem:Affid=91088 /s /thirdparty /upgrade MD5: E1DD69840A8965E125AA7F311B6D8EFB)
      • avg_antivirus_free_setup.exe (PID: 6576 cmdline: "C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exe" /silent /ws /psh:92pTu5fbOaMVqHXWzRazGwcsjZOgyQNZV0BXrS1y4TWZ27PXSitlzA5vE30PraTCAoRM4emN7pEfhI MD5: 26816AF65F2A3F1C61FB44C682510C97)
        • avg_antivirus_free_online_setup.exe (PID: 824 cmdline: "C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe" /silent /ws /psh:92pTu5fbOaMVqHXWzRazGwcsjZOgyQNZV0BXrS1y4TWZ27PXSitlzA5vE30PraTCAoRM4emN7pEfhI /cookie:mmm_irs_ppi_902_451_o /ga_clientid:1840c678-d62a-4945-8e4f-36eaf3f0c4a5 /edat_dir:C:\Windows\Temp\asw.481015ae89dc80a3 MD5: 89799311702BD341AA9B7DAEE903B5C2)
          • icarus.exe (PID: 7884 cmdline: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\icarus-info.xml /install /silent /ws /psh:92pTu5fbOaMVqHXWzRazGwcsjZOgyQNZV0BXrS1y4TWZ27PXSitlzA5vE30PraTCAoRM4emN7pEfhI /cookie:mmm_irs_ppi_902_451_o /edat_dir:C:\Windows\Temp\asw.481015ae89dc80a3 /track-guid:1840c678-d62a-4945-8e4f-36eaf3f0c4a5 MD5: 251369428A0E2D87308E7A9FAA387270)
      • BitComet.exe (PID: 6072 cmdline: "C:\Program Files\BitComet\BitComet.exe" --no_elevated MD5: BFDFE1495ADA381F3D57C6E6DF04E189)
      • WerFault.exe (PID: 1696 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6740 -s 968 MD5: C31336C1EFC2CCB44B4326EA793040F2)
      • WerFault.exe (PID: 7796 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6740 -s 968 MD5: C31336C1EFC2CCB44B4326EA793040F2)
  • svchost.exe (PID: 5688 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • BitComet.exe (PID: 6032 cmdline: "C:\Program Files\BitComet\BitComet.exe" MD5: BFDFE1495ADA381F3D57C6E6DF04E189)
    • UPNP.exe (PID: 5212 cmdline: "C:\Program Files\BitComet\tools\UPNP.exe" -addfw -app BitComet -tcpport 9652 -udpport 9652 -q MD5: FEBBAF0C03103A63E0141A96535B7745)
    • msedgewebview2.exe (PID: 3332 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=6032.3612.7348265561393428437 MD5: 9909D978B39FB7369F511D8506C17CA0)
      • msedgewebview2.exe (PID: 3652 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Local\BitComet\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Local\BitComet\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x15c,0x160,0x164,0x138,0x170,0x7ffdfab78e88,0x7ffdfab78e98,0x7ffdfab78ea8 MD5: 9909D978B39FB7369F511D8506C17CA0)
      • msedgewebview2.exe (PID: 2932 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2484 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:2 MD5: 9909D978B39FB7369F511D8506C17CA0)
      • msedgewebview2.exe (PID: 3608 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2924 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:3 MD5: 9909D978B39FB7369F511D8506C17CA0)
      • msedgewebview2.exe (PID: 980 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2920 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:8 MD5: 9909D978B39FB7369F511D8506C17CA0)
      • msedgewebview2.exe (PID: 1236 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6693313984 --mojo-platform-channel-handle=3272 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:1 MD5: 9909D978B39FB7369F511D8506C17CA0)
      • msedgewebview2.exe (PID: 2672 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6693485965 --mojo-platform-channel-handle=3588 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:1 MD5: 9909D978B39FB7369F511D8506C17CA0)
      • msedgewebview2.exe (PID: 6580 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6693635288 --mojo-platform-channel-handle=3776 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:1 MD5: 9909D978B39FB7369F511D8506C17CA0)
      • msedgewebview2.exe (PID: 6768 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6693754114 --mojo-platform-channel-handle=4048 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:1 MD5: 9909D978B39FB7369F511D8506C17CA0)
      • msedgewebview2.exe (PID: 7288 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --disable-gpu-compositing --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6697808392 --mojo-platform-channel-handle=4692 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:1 MD5: 9909D978B39FB7369F511D8506C17CA0)
      • msedgewebview2.exe (PID: 7352 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --disable-gpu-compositing --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6698303265 --mojo-platform-channel-handle=4760 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:1 MD5: 9909D978B39FB7369F511D8506C17CA0)
    • UPNP.exe (PID: 2472 cmdline: "C:\Program Files\BitComet\tools\UPNP.exe" -add -app BitComet -lanip 192.168.2.4 -tcpport 9652 -udpport 9652 -q MD5: FEBBAF0C03103A63E0141A96535B7745)
  • BitCometService.exe (PID: 4140 cmdline: "C:\Program Files\BitComet\tools\BitCometService.exe" -service MD5: AE7FBFF183FF30913EBEB38913E8CFAD)
  • svchost.exe (PID: 5808 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
    • WerFault.exe (PID: 5180 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 6740 -ip 6740 MD5: C31336C1EFC2CCB44B4326EA793040F2)
    • WerFault.exe (PID: 7776 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 6740 -ip 6740 MD5: C31336C1EFC2CCB44B4326EA793040F2)
  • svchost.exe (PID: 4248 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
PrivateLoaderAccording to sekoia, PrivateLoader is a modular malware whose main capability is to download and execute one or several payloads. The loader implements anti-analysis techniques, fingerprints the compromised host and reports statistics to its C2 server.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.privateloader

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Program Files\BitComet\tools\BitCometService.exeJoeSecurity_PrivateLoaderYara detected PrivateLoaderJoe Security
    C:\Program Files\BitComet\tools\VideoSnapshot.exeJoeSecurity_PrivateLoaderYara detected PrivateLoaderJoe Security
      C:\Program Files\BitComet\tools\VideoSnapshot.exeJoeSecurity_PrivateLoaderYara detected PrivateLoaderJoe Security
        C:\Users\user\AppData\Local\Temp\nsrA1A4.tmpJoeSecurity_PrivateLoaderYara detected PrivateLoaderJoe Security

          Memory Dumps

          SourceRuleDescriptionAuthorStrings
          00000007.00000000.2218766402.0000000000401000.00000020.00000001.01000000.00000011.sdmpJoeSecurity_PrivateLoaderYara detected PrivateLoaderJoe Security
            0000000F.00000000.2414944136.0000000000401000.00000020.00000001.01000000.00000011.sdmpJoeSecurity_PrivateLoaderYara detected PrivateLoaderJoe Security
              0000000F.00000002.2966448744.0000000000401000.00000020.00000001.01000000.00000011.sdmpJoeSecurity_PrivateLoaderYara detected PrivateLoaderJoe Security
                00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_PrivateLoaderYara detected PrivateLoaderJoe Security
                  00000001.00000003.2291295416.0000000000884000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_QueryWinSATClassIDYara detected QueryWinSAT ClassIDJoe Security
                    Click to see the 2 entries

                    Unpacked PEs

                    SourceRuleDescriptionAuthorStrings
                    7.0.BitCometService.exe.400000.0.unpackJoeSecurity_PrivateLoaderYara detected PrivateLoaderJoe Security
                      7.2.BitCometService.exe.400000.0.unpackJoeSecurity_PrivateLoaderYara detected PrivateLoaderJoe Security
                        15.2.BitCometService.exe.400000.0.unpackJoeSecurity_PrivateLoaderYara detected PrivateLoaderJoe Security
                          15.0.BitCometService.exe.400000.0.unpackJoeSecurity_PrivateLoaderYara detected PrivateLoaderJoe Security
                            5.2.BitComet_2.08a_setup.exe.2795664.2.unpackJoeSecurity_PrivateLoaderYara detected PrivateLoaderJoe Security
                              Click to see the 2 entries

                              Sigma Signatures

                              System Summary

                              barindex
                              Sigma detected: Windows Processes Suspicious Parent Directory
                              Source: Process startedAuthor: vburov: Data: Command: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, ProcessId: 5688, ProcessName: svchost.exe

                              Snort Signatures

                              ⊘No Snort rule has matched

                              Suricata Signatures

                              Timestamp:2024-07-18T21:39:09.215258+0200
                              SID:2053283
                              Source Port:49753
                              Destination Port:443
                              Protocol:TCP
                              Classtype:A Network Trojan was detected
                              Timestamp:2024-07-18T21:38:07.239150+0200
                              SID:2053280
                              Source Port:49734
                              Destination Port:443
                              Protocol:TCP
                              Classtype:A Network Trojan was detected
                              Timestamp:2024-07-18T21:38:57.817749+0200
                              SID:2053283
                              Source Port:49748
                              Destination Port:443
                              Protocol:TCP
                              Classtype:A Network Trojan was detected
                              Timestamp:2024-07-18T21:38:09.209567+0200
                              SID:2053283
                              Source Port:49735
                              Destination Port:443
                              Protocol:TCP
                              Classtype:A Network Trojan was detected
                              Timestamp:2024-07-18T21:39:07.291314+0200
                              SID:2053283
                              Source Port:49750
                              Destination Port:443
                              Protocol:TCP
                              Classtype:A Network Trojan was detected

                              Joe Sandbox Signatures

                              Click to jump to signature section

                              Show All Signature Results

                              AV Detection

                              barindex
                              Multi AV Scanner detection for submitted file
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.exeReversingLabs: Detection: 18%
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_006814F0 CryptMsgGetParam,CryptMsgGetParam,CryptMsgGetParam,CryptMsgGetParam,CertGetSubjectCertificateFromStore,CryptMsgGetParam,CertFreeCRLContext,CertFreeCRLContext,10_2_006814F0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_006817A0 CryptQueryObject,CryptMsgClose,CertCloseStore,CryptMsgClose,CertCloseStore,CryptMsgClose,CryptQueryObject,CryptMsgClose,CertCloseStore,CertCloseStore,CryptMsgClose,CertCloseStore,CryptMsgClose,CertCloseStore,CertCloseStore,CryptMsgClose,CertCloseStore,CryptMsgClose,CertCloseStore,CryptMsgClose,CertCloseStore,10_2_006817A0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_00635870 GetCurrentProcessId,GetCurrentThreadId,CreateFileW,CreateFileW,CreateFileW,CreateFileW,CreateFileW,CreateFileW,UuidCreate,UuidCreate,CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,10_2_00635870
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_00636220 GetCurrentProcessId,GetCurrentThreadId,CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,DeviceIoControl,DeviceIoControl,10_2_00636220
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_0066E610 CryptMsgClose,10_2_0066E610
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_006367B0 GetCurrentProcessId,GetCurrentThreadId,CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,DeviceIoControl,DeviceIoControl,10_2_006367B0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_0066EB60 CryptQueryObject,CryptMsgClose,CertCloseStore,CryptMsgClose,CertCloseStore,CryptQueryObject,CryptMsgClose,CryptMsgClose,CertCloseStore,CertCloseStore,CryptMsgClose,CertCloseStore,CryptMsgClose,CryptMsgClose,CertCloseStore,CertCloseStore,CryptMsgClose,CertCloseStore,CryptMsgClose,CertCloseStore,CryptMsgClose,CertCloseStore,10_2_0066EB60
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_0066F150 CryptMsgGetParam,CryptMsgGetParam,CryptMsgGetParam,CertGetSubjectCertificateFromStore,CertFreeCRLContext,10_2_0066F150
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_0066F3C0 CryptMsgGetParam,CryptMsgGetParam,CryptMsgGetParam,CertGetSubjectCertificateFromStore,CertGetNameStringW,CertGetNameStringW,CertGetCertificateChain,CertFreeCertificateChain,CertFreeCertificateChain,CertVerifyCertificateChainPolicy,CertFreeCertificateChain,CertFreeCRLContext,CertFreeCRLContext,10_2_0066F3C0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 11_2_000AB0E0 CryptDestroyHash,CryptDestroyHash,11_2_000AB0E0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 11_2_000A9250 CryptGenRandom,GetLastError,__CxxThrowException@8,11_2_000A9250
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 11_2_000A82F0 CryptDestroyHash,11_2_000A82F0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 11_2_000A9450 CryptCreateHash,CryptDestroyHash,GetLastError,__CxxThrowException@8,11_2_000A9450
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 11_2_000A8DC0 lstrcatA,CryptAcquireContextA,CryptReleaseContext,GetLastError,__CxxThrowException@8,CryptReleaseContext,11_2_000A8DC0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 11_2_000A9020 CryptCreateHash,CryptDestroyHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,GetLastError,__CxxThrowException@8,GetLastError,__CxxThrowException@8,GetLastError,__CxxThrowException@8,GetLastError,__CxxThrowException@8,11_2_000A9020
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 11_2_000A8260 CryptDestroyHash,11_2_000A8260
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 11_2_000A9340 CryptGetHashParam,CryptGetHashParam,GetLastError,__CxxThrowException@8,GetLastError,__CxxThrowException@8,11_2_000A9340
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 11_2_000A94D0 CryptHashData,GetLastError,__CxxThrowException@8,11_2_000A94D0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 11_2_000C2660 CryptReleaseContext,11_2_000C2660
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 11_2_000A8EF0 CryptReleaseContext,11_2_000A8EF0
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D10BB0 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GlobalMemoryStatusEx,GetDiskFreeSpaceExW,GetSystemTimes,QueryPerformanceCounter,CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,12_2_00D10BB0
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D45AD0 CryptProtectData,GetLastError,Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error,CryptUnprotectData,GetLastError,Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error,GetLastError,Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error,12_2_00D45AD0
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2450616405.0000000005E8C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: -----BEGIN PUBLIC KEY-----memstr_efd5b7aa-e
                              Source: C:\Program Files\BitComet\BitComet.exeRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION BitComet.exe

                              Compliance

                              barindex
                              Uses 32bit PE files
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
                              Found installer window with terms and condition text
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpWindow detected: HYPERLINK "http://www.bitcomet.com/doc/term-of-use.php" End User License AgreementHYPERLINK "https://www.bitcomet.com/doc/privacy-policy.php" Privacy PolicyThis will install BitComet to your computer click "Next" to continue.BitComet is a free BitTorrent download client! BitComet is powerful super-fast and easy-to-use.Welcome to BitComet Installer&NextCancel
                              Creates a directory in C:\Program Files
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitCometJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\ReadMe.txtJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\License.txtJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\ChangeLog.txtJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\BitComet.exeJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\CrashReport.exeJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\WebView2Loader.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\langJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-ar.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-bg.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-bs.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-ca.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-cs.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-da.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-de.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-el.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-en_US.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-es.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-et.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-eu.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-fa.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-fi.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-fr.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-gl.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-he.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-hr.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-hu.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-hy.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-id.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-it.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-ja.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-kk.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-kn.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-ko.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-ku.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-lt.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-lv.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-mk.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-ms.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-nb.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-ne.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-nl.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-pl.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-pt.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-pt_BR.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-ro.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-ru.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-sk.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-sl.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-sq.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-sr.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-sv.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-ta.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-th.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-tr.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-ug.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-uk.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-ur.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-vi.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-zh_CN.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-zh_TW.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\HowTo-Translate.txtJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\ip2locationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\ip2location\ip2location.binJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\ip2location\ip2location-country-multilingual.csvJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\toolsJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\tools\UPNP.exeJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\tools\VideoSnapshot.exeJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\tools\Updater.exeJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\tools\BitCometToastsNotifier.exeJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\tools\BitCometToastsNotifier.pngJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\tools\ChromeLauncher.exeJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\tools\ChromeLauncherManifest.jsonJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\tools\ChromeExtension.crxJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\tools\EdgeExtension.crxJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\tools\FirefoxLauncherManifest.jsonJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\tools\FirefoxExtension.xpiJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\tools\BitCometAgent_1.92.7.9.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\tools\BitCometBHO_1.5.4.11.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\tools\BitCometService.exeJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\BitComet.urlJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\uninst.exeJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\analyticsmanager.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\analyticstelemetry.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\balloon_safe_annotation.png
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\browserhost.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\browserplugin.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\downloadscan.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\eventmanager.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\icon_complete.png
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\icon_failed.png
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\icon_laptop.png
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\installer.exe
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jquery-1.9.0.min.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\l10n.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\logicmodule.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\logicscripts.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\lookupmanager.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\main_close_large.png
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\mcafeecerts.xml
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\mcafee_pc_install_icon.png
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\mcafee_pc_install_icon2.png
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\mfw-mwb.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\mfw-nps.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\mfw-webadvisor.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\mfw.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\resource.dll
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\resourcedll.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\servicehost.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\settingmanager.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\taskmanager.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\telemetry.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\uihost.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\uimanager.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\uninstaller.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\updater.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\wa-common.css
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\wa-core.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\wa-install.css
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\wa-install.html
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\wa-ui-install.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\wa-utils.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\wataskmanager.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\wa_install_check.png
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\wa_install_check2.png
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\wa_install_close.png
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\wa_install_close2.png
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\wa_install_error.png
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\wa_logo.png
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\wa_logo2.png
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\webadvisor.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\webadvisor.ico
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\wssdep.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-cs-CZ.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-da-DK.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-de-DE.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-el-GR.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-en-US.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-es-ES.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-es-MX.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-fi-FI.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-fr-CA.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-fr-FR.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-hr-HR.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-hu-HU.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-it-IT.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-ja-JP.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-ko-KR.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-nb-NO.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-nl-NL.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-pl-PL.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-pt-BR.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-pt-PT.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-ru-RU.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-sk-SK.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-sr-Latn-CS.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-sv-SE.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-tr-TR.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-zh-CN.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-zh-TW.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-cs-CZ.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-da-DK.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-de-DE.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-el-GR.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-en-US.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-es-ES.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-es-MX.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-fi-FI.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-fr-CA.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-fr-FR.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-hr-HR.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-hu-HU.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-it-IT.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-ja-JP.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-ko-KR.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-nb-NO.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-nl-NL.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-pl-PL.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-pt-BR.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-pt-PT.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-ru-RU.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-sk-SK.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-sr-Latn-CS.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-sv-SE.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-tr-TR.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-zh-CN.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-zh-TW.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-cs-CZ.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-da-DK.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-de-DE.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-el-GR.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-en-US.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-es-ES.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-es-MX.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-fi-FI.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-fr-CA.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-fr-FR.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-hr-HR.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-hu-HU.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-it-IT.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-ja-JP.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-ko-KR.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-nb-NO.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-nl-NL.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-pl-PL.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-pt-BR.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-pt-PT.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-ru-RU.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-sk-SK.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-sr-Latn-CS.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-sv-SE.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-tr-TR.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-zh-CN.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-zh-TW.js
                              Creates license or readme file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeFile created: C:\Program Files\BitComet\ReadMe.txtJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeFile created: C:\Program Files\BitComet\License.txtJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-cs-CZ.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-da-DK.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-de-DE.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-el-GR.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-en-US.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-es-ES.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-es-MX.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-fi-FI.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-fr-CA.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-fr-FR.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-hr-HR.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-hu-HU.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-it-IT.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-ja-JP.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-ko-KR.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-nb-NO.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-nl-NL.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-pl-PL.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-pt-BR.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-pt-PT.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-ru-RU.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-sk-SK.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-sr-Latn-CS.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-sv-SE.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-tr-TR.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-zh-CN.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-zh-TW.txt
                              PE / OLE file has a valid certificate
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.exeStatic PE information: certificate valid
                              Uses secure TLS version for HTTPS connections
                              Source: unknownHTTPS traffic detected: 13.249.12.125:443 -> 192.168.2.4:49734 version: TLS 1.2
                              Source: unknownHTTPS traffic detected: 13.249.12.125:443 -> 192.168.2.4:49735 version: TLS 1.2
                              Source: unknownHTTPS traffic detected: 13.249.12.125:443 -> 192.168.2.4:49737 version: TLS 1.2
                              Source: unknownHTTPS traffic detected: 13.249.12.125:443 -> 192.168.2.4:49739 version: TLS 1.2
                              Source: unknownHTTPS traffic detected: 13.249.12.125:443 -> 192.168.2.4:49745 version: TLS 1.2
                              Source: unknownHTTPS traffic detected: 13.249.12.125:443 -> 192.168.2.4:49746 version: TLS 1.2
                              Source: unknownHTTPS traffic detected: 13.249.12.125:443 -> 192.168.2.4:49748 version: TLS 1.2
                              Source: unknownHTTPS traffic detected: 143.204.205.88:443 -> 192.168.2.4:49750 version: TLS 1.2
                              Source: unknownHTTPS traffic detected: 52.25.171.187:443 -> 192.168.2.4:49751 version: TLS 1.2
                              Source: unknownHTTPS traffic detected: 143.204.205.88:443 -> 192.168.2.4:49753 version: TLS 1.2
                              Source: unknownHTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49760 version: TLS 1.2
                              Source: unknownHTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49762 version: TLS 1.2
                              Source: unknownHTTPS traffic detected: 52.25.171.187:443 -> 192.168.2.4:49777 version: TLS 1.2
                              Source: unknownHTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49832 version: TLS 1.2
                              Source: unknownHTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49833 version: TLS 1.2
                              Source: unknownHTTPS traffic detected: 34.160.176.28:443 -> 192.168.2.4:49834 version: TLS 1.2
                              Source: unknownHTTPS traffic detected: 34.160.176.28:443 -> 192.168.2.4:49836 version: TLS 1.2
                              Source: unknownHTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49867 version: TLS 1.2
                              Source: unknownHTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49869 version: TLS 1.2
                              Source: unknownHTTPS traffic detected: 34.160.176.28:443 -> 192.168.2.4:49870 version: TLS 1.2
                              Contains modern PE file flags such as dynamic base (ASLR) or NX
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                              Binary contains paths to debug symbols
                              Source: Binary string: F:\develop\VideoSnap\app\Release_unicode\VideoSnapshot.pdb source: BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmp
                              Source: Binary string: E:\develop\BitCometAgent_ActiveX\app\Release_Unicode\BitCometAgent_ActiveX.pdb source: BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmp
                              Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x64\avDump.pdb= source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2539291834.0000000005D30000.00000004.00000020.00020000.00000000.sdmp
                              Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x86\icarus_mod.pdb source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2418861617.0000000005B49000.00000004.00000020.00020000.00000000.sdmp
                              Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x86\icarus_sfx.pdb source: avg_antivirus_free_online_setup.exe, 0000000C.00000002.2995522970.0000000005490000.00000002.00000001.00040000.00000018.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000000.2390280020.0000000000DC7000.00000002.00000001.01000000.00000018.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000002.2964747983.0000000000DC7000.00000002.00000001.01000000.00000018.sdmp
                              Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x64\icarus_ui.pdb source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2504355859.0000000006006000.00000004.00000020.00020000.00000000.sdmp
                              Source: Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\Win32\Release\SaBsi.pdb source: saBSI.exe, 0000000A.00000000.2344892193.00000000006DE000.00000002.00000001.01000000.00000016.sdmp, saBSI.exe, 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmp
                              Source: Binary string: E:\develop\tools\desktop-toasts\Release\BitCometToastsNotifier.pdb source: BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmp
                              Source: Binary string: C:\Source\Repos\DS-Platform\zbShield-Utils-CPP\zbShieldUtils\bin\Release\zbShieldUtils.pdb source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2405003876.00000000075E0000.00000004.00001000.00020000.00000000.sdmp
                              Source: Binary string: D:\develop\BitComet_2.08a\app\Release_unicode_x64\GUI_BitComet_wx.pdb source: BitComet.exe, 0000000D.00000002.2420857876.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmp, BitComet.exe, 0000000D.00000000.2403166450.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmp
                              Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x64\avDump.pdb source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2539291834.0000000005D30000.00000004.00000020.00020000.00000000.sdmp
                              Source: Binary string: d:\Develop\BitCometExtension_IE\app\release_unicode\BitCometBHO.pdb source: BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.000000000276B000.00000004.00000020.00020000.00000000.sdmp
                              Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x64\AvBugReport.pdb source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2577221124.0000000005DA0000.00000004.00000020.00020000.00000000.sdmp
                              Source: Binary string: D:\develop\CrashReport\CrashRpt_v3\bin\x64\Release LIB\CrashReport.pdbx source: BitComet.exe, 0000000D.00000003.2405439939.0000023E831E0000.00000004.00001000.00020000.00000000.sdmp
                              Source: Binary string: #F:\develop\VideoSnap\app\Release_unicode\VideoSnapshot.pdb source: BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmp
                              Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x64\icarus.pdb source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2450616405.0000000005E8C000.00000004.00000020.00020000.00000000.sdmp
                              Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x64\icarus.pdbU source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2450616405.0000000005E8C000.00000004.00000020.00020000.00000000.sdmp
                              Source: Binary string: C:\BUILD\work\8b0ebd312dc47f30\projects\avast\microstub\x86\Release\microstub.pdb source: avg_antivirus_free_setup.exe, 0000000B.00000000.2364390202.00000000000C3000.00000002.00000001.01000000.00000017.sdmp, avg_antivirus_free_setup.exe, 0000000B.00000002.2963084059.00000000000C3000.00000002.00000001.01000000.00000017.sdmp
                              Source: Binary string: D:\develop\CrashReport\CrashRpt_v3\bin\x64\Release LIB\CrashReport.pdb source: BitComet.exe, 0000000D.00000003.2405439939.0000023E831E0000.00000004.00001000.00020000.00000000.sdmp
                              Source: Binary string: E:\develop\BitCometExtension_Chrome\bc_launcher_for_chrome\Release\ChromeLauncher.pdb source: BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmp

                              Spreading

                              barindex
                              Yara detected PrivateLoader
                              Source: Yara matchFile source: 7.0.BitCometService.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 7.2.BitCometService.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 15.2.BitCometService.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 15.0.BitCometService.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 5.2.BitComet_2.08a_setup.exe.2795664.2.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 5.2.BitComet_2.08a_setup.exe.2a24690.3.raw.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 5.2.BitComet_2.08a_setup.exe.2795664.2.raw.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 00000007.00000000.2218766402.0000000000401000.00000020.00000001.01000000.00000011.sdmp, type: MEMORY
                              Source: Yara matchFile source: 0000000F.00000000.2414944136.0000000000401000.00000020.00000001.01000000.00000011.sdmp, type: MEMORY
                              Source: Yara matchFile source: 0000000F.00000002.2966448744.0000000000401000.00000020.00000001.01000000.00000011.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000007.00000002.2219985855.0000000000401000.00000020.00000001.01000000.00000011.sdmp, type: MEMORY
                              Source: Yara matchFile source: C:\Program Files\BitComet\tools\BitCometService.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files\BitComet\tools\VideoSnapshot.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\nsrA1A4.tmp, type: DROPPED
                              Source: C:\Program Files\BitComet\BitComet.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
                              Source: C:\Program Files\BitComet\BitComet.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
                              Source: C:\Program Files\BitComet\BitComet.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
                              Source: C:\Program Files\BitComet\BitComet.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
                              Source: C:\Program Files\BitComet\BitComet.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
                              Source: C:\Program Files\BitComet\BitComet.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
                              Source: C:\Program Files\BitComet\BitComet.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
                              Source: C:\Program Files\BitComet\BitComet.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
                              Source: C:\Program Files\BitComet\BitComet.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
                              Source: C:\Program Files\BitComet\BitComet.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
                              Source: C:\Program Files\BitComet\BitComet.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32
                              Source: C:\Program Files\BitComet\BitComet.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer
                              Source: C:\Program Files\BitComet\BitComet.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
                              Source: C:\Program Files\BitComet\BitComet.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation
                              Source: C:\Program Files\BitComet\BitComet.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
                              Source: C:\Program Files\BitComet\BitComet.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeCode function: 5_2_0040672B FindFirstFileW,FindClose,5_2_0040672B
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeCode function: 5_2_00405AFA CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,5_2_00405AFA
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeCode function: 5_2_00402868 FindFirstFileW,5_2_00402868
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D0C5F0 FindFirstFileExW,GetLastError,PathMatchSpecW,FindNextFileW,GetLastError,FindClose,12_2_00D0C5F0
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D0A030 FindFirstFileW,FindNextFileW,FindClose,GetFileAttributesW,GetFileAttributesW,SetFileAttributesW,RemoveDirectoryW,Sleep,GetFileAttributesW,12_2_00D0A030
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D34F20 FindFirstFileW,MoveFileExW,GetLastError,FindNextFileW,GetFileAttributesW,GetLastError,MoveFileExW,GetLastError,FindClose,12_2_00D34F20
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpFile opened: C:\Users\userJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpFile opened: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmpJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpFile opened: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extractJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpFile opened: C:\Users\user\AppDataJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpFile opened: C:\Users\user\AppData\Local\TempJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpFile opened: C:\Users\user\AppData\LocalJump to behavior

                              Networking

                              barindex
                              Yara detected PrivateLoader
                              Source: Yara matchFile source: 7.0.BitCometService.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 7.2.BitCometService.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 15.2.BitCometService.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 15.0.BitCometService.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 5.2.BitComet_2.08a_setup.exe.2795664.2.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 5.2.BitComet_2.08a_setup.exe.2a24690.3.raw.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 5.2.BitComet_2.08a_setup.exe.2795664.2.raw.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 00000007.00000000.2218766402.0000000000401000.00000020.00000001.01000000.00000011.sdmp, type: MEMORY
                              Source: Yara matchFile source: 0000000F.00000000.2414944136.0000000000401000.00000020.00000001.01000000.00000011.sdmp, type: MEMORY
                              Source: Yara matchFile source: 0000000F.00000002.2966448744.0000000000401000.00000020.00000001.01000000.00000011.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000007.00000002.2219985855.0000000000401000.00000020.00000001.01000000.00000011.sdmp, type: MEMORY
                              Source: Yara matchFile source: C:\Program Files\BitComet\tools\BitCometService.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files\BitComet\tools\VideoSnapshot.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\nsrA1A4.tmp, type: DROPPED
                              NDIS Filter Driver detected (likely used to intercept and sniff network traffic)
                              Source: icarus_product.dll0.39.drStatic PE information: Found NDIS imports: FwpmCalloutDestroyEnumHandle0, FwpmFilterDestroyEnumHandle0, FwpmFreeMemory0, FwpmSubLayerDestroyEnumHandle0, FwpmSubLayerEnum0, FwpmEngineClose0, FwpmTransactionAbort0, FwpmEngineOpen0, FwpmCalloutEnum0, FwpmProviderDeleteByKey0, FwpmTransactionBegin0, FwpmFilterDeleteByKey0, FwpmCalloutCreateEnumHandle0, FwpmTransactionCommit0, FwpmSubLayerCreateEnumHandle0, FwpmFilterCreateEnumHandle0, FwpmSubLayerDeleteByKey0, FwpmCalloutDeleteByKey0, FwpmFilterEnum0
                              Source: global trafficTCP traffic: 192.168.2.4:49788 -> 161.97.134.106:5437
                              Source: global trafficUDP traffic: 192.168.2.4:9652 -> 87.98.162.88:6881
                              Source: global trafficUDP traffic: 192.168.2.4:9652 -> 146.12.137.105:50214
                              Source: Joe Sandbox ViewIP Address: 162.159.61.3 162.159.61.3
                              Source: Joe Sandbox ViewIP Address: 172.64.41.3 172.64.41.3
                              Source: Joe Sandbox ViewIP Address: 34.160.176.28 34.160.176.28
                              Source: Joe Sandbox ViewJA3 fingerprint: 74954a0c86284d0d6e1c4efefe92b521
                              Source: Joe Sandbox ViewJA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
                              Source: global trafficHTTP traffic detected: POST /o HTTP/1.1Connection: Keep-AliveContent-Type: application/json; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 122Host: d11iilsblp9z11.cloudfront.net
                              Source: global trafficHTTP traffic detected: POST /zbd HTTP/1.1Connection: Keep-AliveContent-Type: application/json; Charset=UTF-8Accept: */*Authorization: Signature=c0ca984d9cd1b9e9ffdf6097b502a49003af5070b14ac3fa1760d15f36f3f81fUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 273Host: d11iilsblp9z11.cloudfront.net
                              Source: global trafficHTTP traffic detected: POST /zbd HTTP/1.1Connection: Keep-AliveContent-Type: application/json; Charset=UTF-8Accept: */*Authorization: Signature=c0ca984d9cd1b9e9ffdf6097b502a49003af5070b14ac3fa1760d15f36f3f81fUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 289Host: d11iilsblp9z11.cloudfront.net
                              Source: global trafficHTTP traffic detected: POST /zbd HTTP/1.1Connection: Keep-AliveContent-Type: application/json; Charset=UTF-8Accept: */*Authorization: Signature=c0ca984d9cd1b9e9ffdf6097b502a49003af5070b14ac3fa1760d15f36f3f81fUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 346Host: d11iilsblp9z11.cloudfront.net
                              Source: global trafficHTTP traffic detected: POST /zbd HTTP/1.1Connection: Keep-AliveContent-Type: application/json; Charset=UTF-8Accept: */*Authorization: Signature=c0ca984d9cd1b9e9ffdf6097b502a49003af5070b14ac3fa1760d15f36f3f81fUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 354Host: d11iilsblp9z11.cloudfront.net
                              Source: global trafficHTTP traffic detected: GET /client/bitcomet/?ver=2.08&intl=en_us&osintl=jv&cid=ae7b79c1d0de3420440a531a8fc59151&btcnt=0&httpcnt=0&p=x64&idt=20240718 HTTP/1.1Host: update.bitcomet.comConnection: closeAccept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
                              Source: global trafficHTTP traffic detected: GET /start/en_us/2.08/ HTTP/1.1Host: inside.bitcomet.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
                              Source: global trafficHTTP traffic detected: GET /client/bitcomet/?ver=2.08&intl=en_us&osintl=jv&cid=ae7b79c1d0de3420440a531a8fc59151&btcnt=0&httpcnt=0&p=x64&idt=20240718 HTTP/1.1Host: update.bitcomet.comConnection: closeAccept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
                              Source: global trafficHTTP traffic detected: GET /client/bitcomet/?ver=2.08&intl=en_us&osintl=jv&cid=ae7b79c1d0de3420440a531a8fc59151&btcnt=0&httpcnt=0&p=x64&idt=20240718 HTTP/1.1Host: update.bitcomet.comConnection: closeAccept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
                              Source: global trafficHTTP traffic detected: GET /client/bitcomet/?ver=2.08&intl=en_us&osintl=jv&cid=ae7b79c1d0de3420440a531a8fc59151&btcnt=0&httpcnt=0&p=x64&idt=20240718 HTTP/1.1Host: update.bitcomet.comConnection: closeAccept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
                              Source: global trafficHTTP traffic detected: GET /client/bitcomet/?ver=2.08&intl=en_us&osintl=jv&cid=ae7b79c1d0de3420440a531a8fc59151&btcnt=0&httpcnt=0&p=x64&idt=20240718 HTTP/1.1Host: update.bitcomet.comConnection: closeAccept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
                              Source: global trafficHTTP traffic detected: GET /?random=1&style=iframe HTTP/1.1Host: apphit.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://inside.bitcomet.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
                              Source: global trafficHTTP traffic detected: GET /app/veracrypt?style=iframe&link= HTTP/1.1Host: apphit.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://inside.bitcomet.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: XSRF-TOKEN=eyJpdiI6IllZdWd4SGgxeCtkeEZoazN3RlFWcVE9PSIsInZhbHVlIjoiUFRaT1VuWXNhNEtXZlluK1ZoR29qMXY5dDFpTTVXUWFkSXA2dGVtZ0llckxNZVNtVS9TcVNhK0ZnZWRFM2U4VnhJdDhBN0I5Y3ZMZTdXU2hTMXpGMzJrTjlsZGllQ1MzNEFWTTZLRUpTTnJTVU1kbmM0dytaT05pTzZITnpqblAiLCJtYWMiOiI1ODNkMmQ0Njk0NjhiMzE0ZWM0OWU5Y2RmOGRmMDI2ZDNkZTg4ZGY4NGMzZTQ1NGU1OTlmY2EwNGY2Yjk4ODZjIiwidGFnIjoiIn0%3D; apphit_session=eyJpdiI6IjNsamJxYVYza29BR0JyM2Z2ZzJvWWc9PSIsInZhbHVlIjoiWk9OQlZlditaSWxuVS9NVmVxRWtRQXVIcEtnam55VjZxdzFNMUxuMFVISjVYZEh6ZzRaZFBwK0dNR05hMXd6a0t6eWdiNDJDL2pPenpUTkJJUVgxMlRqN1cwMDVEcUJIYm4vSVNjckplM0w1RVArY3NsQm5NcnZvaDdDZFBBT1AiLCJtYWMiOiIyNjVkY2Y4MDQ2OWFlYjhhN2I3ODMwYTg3NjliM2YwODU0ZTIyN2QzNzM5ZGRlZGE3NmMxOTAxOTllZDY2MDU5IiwidGFnIjoiIn0%3D
                              Source: global trafficHTTP traffic detected: POST /api/browser/edge/navigate/3 HTTP/1.1Host: nav-edge.smartscreen.microsoft.comConnection: keep-aliveContent-Length: 1201Authorization: SmartScreenHash eyJhdXRoSWQiOiJjMmU0ZjljYS1lZjYwLTQyY2EtOTAyZi1mNzgwZTFmMTk2YTciLCAia2V5IjoiL2R6S3ZyNE1Ua3UxWWNRR3V6eVBTUT09IiwgImhhc2giOiI1dy93RWx4MHV6MD0ifQ==Content-Type: application/json; charset=utf-8Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, br
                              Source: global trafficHTTP traffic detected: GET /css/app.css HTTP/1.1Host: apphit.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://apphit.com/app/veracrypt?style=iframe&link=Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: XSRF-TOKEN=eyJpdiI6IlRDUFdYME9ZcXBrM2hyNWNrYURDTEE9PSIsInZhbHVlIjoiQ2NPTmFwdzRQemwwOEQveERmMXBiYWJURnByZWljd1hKSEV0c1VSUWllQzZvSmRmdTJya05BSDREaVlEeVYxdWMrVEVUc2tGdS9GWUI1Vi8xYnJIZ2dHbzVLM1Bma3A1WXZzVzFsaTlFWHB5YUUxVE1sSUY5d0FxSGlOTWZNOGUiLCJtYWMiOiI5YjFkYmRlNmQxYWNmY2YwOGQ5NDIwNzFiYjg2MDIyMjUzZDJlOWI0ZmZlNmNkMGU3YjJiYmVhNzhiOTZmMzRmIiwidGFnIjoiIn0%3D; apphit_session=eyJpdiI6Imc0WmF2ZDFDMjR5YTJOWG9tWG1MOGc9PSIsInZhbHVlIjoiQzc1OE00bCtvZzVUeW01ajlrVllXMkVCRDBuc1B5bFJwSHRWUUZKME5PeVYrbkpjSHByeU1Va1FlQ0lENTM2LzdiV1BnNDJnWi9IMVRwc0laaFU5KzVFWCtmNmZtNVZtT3dKMHdnT3g1Q2NUWHh0TDRUK0NPT0ZMMEdNOUhlWmsiLCJtYWMiOiI0Mzc4ZjEzZGJkMzc1ZGQwYzhmNzMwYTlkNjBhOWY4MzE2MjdhOTI2OTYwODk5OGIzZjljYWU2NjViZTE0YWJjIiwidGFnIjoiIn0%3D
                              Source: global trafficHTTP traffic detected: GET /image/app/veracrypt/veracrypt-logo.svg HTTP/1.1Host: image.apphit.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://apphit.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
                              Source: global trafficHTTP traffic detected: POST /api/browser/edge/navigate/3 HTTP/1.1Host: nav-edge.smartscreen.microsoft.comConnection: keep-aliveContent-Length: 1258Authorization: SmartScreenHash eyJhdXRoSWQiOiJjMmU0ZjljYS1lZjYwLTQyY2EtOTAyZi1mNzgwZTFmMTk2YTciLCAia2V5IjoiQmkrNEUzcStmdEJyeE9CeXV2YXpOUT09IiwgImhhc2giOiJQaUtDV2sxbktPYz0ifQ==Content-Type: application/json; charset=utf-8Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, br
                              Source: global trafficHTTP traffic detected: GET /gtag/js?id=G-BE27VNW489 HTTP/1.1Host: www.googletagmanager.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://apphit.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
                              Source: global trafficHTTP traffic detected: POST /api/browser/edge/data/toptraffic/3 HTTP/1.1Host: data-edge.smartscreen.microsoft.comConnection: keep-aliveContent-Length: 754Accept: application/octet-stream;application/x-patch-bsdiff;Authorization: SmartScreenHash eyJhdXRoSWQiOiJjMmU0ZjljYS1lZjYwLTQyY2EtOTAyZi1mNzgwZTFmMTk2YTciLCAia2V5IjoiamhZdUhSeUt2NkxSOVZrb08zSTRRQT09IiwgImhhc2giOiJnbWVMa0xJMk8zMD0ifQ==Content-Type: application/json; charset=utf-8If-None-Match: "170540185939602997400506234197983529371"Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, br
                              Source: global trafficHTTP traffic detected: POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1Host: data-edge.smartscreen.microsoft.comConnection: keep-aliveContent-Length: 1129Accept: application/octet-stream;application/x-patch-bsdiff;Authorization: SmartScreenHash eyJhdXRoSWQiOiJjMmU0ZjljYS1lZjYwLTQyY2EtOTAyZi1mNzgwZTFmMTk2YTciLCAia2V5IjoiODRuR2ZNbnhWUG9VaE9ZMlFmaHNPdz09IiwgImhhc2giOiJrQk5Rayt3Vlk0TT0ifQ==Content-Type: application/json; charset=utf-8If-None-Match: "636976985063396749.rel.v2"Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, br
                              Source: global trafficHTTP traffic detected: POST /api/browser/edge/data/settings/3 HTTP/1.1Host: data-edge.smartscreen.microsoft.comConnection: keep-aliveContent-Length: 1129Accept: application/octet-stream;application/x-patch-bsdiff;Authorization: SmartScreenHash eyJhdXRoSWQiOiJjMmU0ZjljYS1lZjYwLTQyY2EtOTAyZi1mNzgwZTFmMTk2YTciLCAia2V5IjoiODRuR2ZNbnhWUG9VaE9ZMlFmaHNPdz09IiwgImhhc2giOiJrQk5Rayt3Vlk0TT0ifQ==Content-Type: application/json; charset=utf-8If-None-Match: "2.0-0"Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, br
                              Source: global trafficHTTP traffic detected: POST /api/browser/edge/navigate/3 HTTP/1.1Host: nav-edge.smartscreen.microsoft.comConnection: keep-aliveContent-Length: 1643Authorization: SmartScreenHash eyJhdXRoSWQiOiJjMmU0ZjljYS1lZjYwLTQyY2EtOTAyZi1mNzgwZTFmMTk2YTciLCAia2V5IjoiYWVKQ0M0NjNpYzJlbjM1SmFqTTEzQT09IiwgImhhc2giOiIzS3F3WklmQ0lCZz0ifQ==Content-Type: application/json; charset=utf-8Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, br
                              Source: global trafficHTTP traffic detected: POST /api/browser/edge/data/toptraffic/3 HTTP/1.1Host: data-edge.smartscreen.microsoft.comConnection: keep-aliveContent-Length: 1101Accept: application/octet-stream;application/x-patch-bsdiff;Authorization: SmartScreenHash eyJhdXRoSWQiOiJjMmU0ZjljYS1lZjYwLTQyY2EtOTAyZi1mNzgwZTFmMTk2YTciLCAia2V5IjoiMDJYYmZmUGFWa1dmV2s5SU00WW1FZz09IiwgImhhc2giOiJ2L0VLYWlzcnBDTT0ifQ==Content-Type: application/json; charset=utf-8If-None-Match: "638004170464094982"Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, br
                              Source: global trafficHTTP traffic detected: POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1Host: data-edge.smartscreen.microsoft.comConnection: keep-aliveContent-Length: 1101Accept: application/octet-stream;application/x-patch-bsdiff;Authorization: SmartScreenHash eyJhdXRoSWQiOiJjMmU0ZjljYS1lZjYwLTQyY2EtOTAyZi1mNzgwZTFmMTk2YTciLCAia2V5IjoiMDJYYmZmUGFWa1dmV2s5SU00WW1FZz09IiwgImhhc2giOiJ2L0VLYWlzcnBDTT0ifQ==Content-Type: application/json; charset=utf-8If-None-Match: "638343870221005468"Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, br
                              Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: apphit.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://apphit.com/app/veracrypt?style=iframe&link=Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: XSRF-TOKEN=eyJpdiI6IlRDUFdYME9ZcXBrM2hyNWNrYURDTEE9PSIsInZhbHVlIjoiQ2NPTmFwdzRQemwwOEQveERmMXBiYWJURnByZWljd1hKSEV0c1VSUWllQzZvSmRmdTJya05BSDREaVlEeVYxdWMrVEVUc2tGdS9GWUI1Vi8xYnJIZ2dHbzVLM1Bma3A1WXZzVzFsaTlFWHB5YUUxVE1sSUY5d0FxSGlOTWZNOGUiLCJtYWMiOiI5YjFkYmRlNmQxYWNmY2YwOGQ5NDIwNzFiYjg2MDIyMjUzZDJlOWI0ZmZlNmNkMGU3YjJiYmVhNzhiOTZmMzRmIiwidGFnIjoiIn0%3D; apphit_session=eyJpdiI6Imc0WmF2ZDFDMjR5YTJOWG9tWG1MOGc9PSIsInZhbHVlIjoiQzc1OE00bCtvZzVUeW01ajlrVllXMkVCRDBuc1B5bFJwSHRWUUZKME5PeVYrbkpjSHByeU1Va1FlQ0lENTM2LzdiV1BnNDJnWi9IMVRwc0laaFU5KzVFWCtmNmZtNVZtT3dKMHdnT3g1Q2NUWHh0TDRUK0NPT0ZMMEdNOUhlWmsiLCJtYWMiOiI0Mzc4ZjEzZGJkMzc1ZGQwYzhmNzMwYTlkNjBhOWY4MzE2MjdhOTI2OTYwODk5OGIzZjljYWU2NjViZTE0YWJjIiwidGFnIjoiIn0%3D
                              Source: global trafficHTTP traffic detected: GET /images/favicon.png HTTP/1.1Host: apphit.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://apphit.com/app/veracrypt?style=iframe&link=Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: XSRF-TOKEN=eyJpdiI6IlRDUFdYME9ZcXBrM2hyNWNrYURDTEE9PSIsInZhbHVlIjoiQ2NPTmFwdzRQemwwOEQveERmMXBiYWJURnByZWljd1hKSEV0c1VSUWllQzZvSmRmdTJya05BSDREaVlEeVYxdWMrVEVUc2tGdS9GWUI1Vi8xYnJIZ2dHbzVLM1Bma3A1WXZzVzFsaTlFWHB5YUUxVE1sSUY5d0FxSGlOTWZNOGUiLCJtYWMiOiI5YjFkYmRlNmQxYWNmY2YwOGQ5NDIwNzFiYjg2MDIyMjUzZDJlOWI0ZmZlNmNkMGU3YjJiYmVhNzhiOTZmMzRmIiwidGFnIjoiIn0%3D; apphit_session=eyJpdiI6Imc0WmF2ZDFDMjR5YTJOWG9tWG1MOGc9PSIsInZhbHVlIjoiQzc1OE00bCtvZzVUeW01ajlrVllXMkVCRDBuc1B5bFJwSHRWUUZKME5PeVYrbkpjSHByeU1Va1FlQ0lENTM2LzdiV1BnNDJnWi9IMVRwc0laaFU5KzVFWCtmNmZtNVZtT3dKMHdnT3g1Q2NUWHh0TDRUK0NPT0ZMMEdNOUhlWmsiLCJtYWMiOiI0Mzc4ZjEzZGJkMzc1ZGQwYzhmNzMwYTlkNjBhOWY4MzE2MjdhOTI2OTYwODk5OGIzZjljYWU2NjViZTE0YWJjIiwidGFnIjoiIn0%3D
                              Source: unknownTCP traffic detected without corresponding DNS query: 161.97.134.106
                              Source: unknownTCP traffic detected without corresponding DNS query: 161.97.134.106
                              Source: unknownTCP traffic detected without corresponding DNS query: 161.97.134.106
                              Source: unknownTCP traffic detected without corresponding DNS query: 161.97.134.106
                              Source: unknownTCP traffic detected without corresponding DNS query: 161.97.134.106
                              Source: unknownTCP traffic detected without corresponding DNS query: 172.183.192.109
                              Source: unknownTCP traffic detected without corresponding DNS query: 172.183.192.109
                              Source: unknownTCP traffic detected without corresponding DNS query: 172.183.192.109
                              Source: unknownTCP traffic detected without corresponding DNS query: 172.183.192.109
                              Source: unknownTCP traffic detected without corresponding DNS query: 172.183.192.109
                              Source: unknownTCP traffic detected without corresponding DNS query: 172.183.192.109
                              Source: unknownTCP traffic detected without corresponding DNS query: 172.183.192.109
                              Source: unknownTCP traffic detected without corresponding DNS query: 172.183.192.109
                              Source: unknownTCP traffic detected without corresponding DNS query: 172.183.192.109
                              Source: unknownTCP traffic detected without corresponding DNS query: 172.183.192.109
                              Source: unknownTCP traffic detected without corresponding DNS query: 172.183.192.109
                              Source: unknownTCP traffic detected without corresponding DNS query: 172.183.192.109
                              Source: unknownTCP traffic detected without corresponding DNS query: 172.183.192.109
                              Source: unknownTCP traffic detected without corresponding DNS query: 172.183.192.109
                              Source: unknownTCP traffic detected without corresponding DNS query: 172.183.192.109
                              Source: unknownTCP traffic detected without corresponding DNS query: 142.250.65.200
                              Source: unknownTCP traffic detected without corresponding DNS query: 142.250.65.200
                              Source: unknownTCP traffic detected without corresponding DNS query: 142.250.65.200
                              Source: unknownTCP traffic detected without corresponding DNS query: 172.183.192.109
                              Source: unknownTCP traffic detected without corresponding DNS query: 142.250.65.200
                              Source: unknownTCP traffic detected without corresponding DNS query: 172.183.192.109
                              Source: unknownTCP traffic detected without corresponding DNS query: 142.250.65.200
                              Source: unknownTCP traffic detected without corresponding DNS query: 172.183.192.109
                              Source: unknownTCP traffic detected without corresponding DNS query: 172.183.192.109
                              Source: unknownTCP traffic detected without corresponding DNS query: 172.183.192.109
                              Source: unknownTCP traffic detected without corresponding DNS query: 142.250.65.200
                              Source: unknownTCP traffic detected without corresponding DNS query: 142.250.65.200
                              Source: unknownTCP traffic detected without corresponding DNS query: 142.250.65.200
                              Source: unknownTCP traffic detected without corresponding DNS query: 172.183.192.109
                              Source: unknownTCP traffic detected without corresponding DNS query: 172.183.192.109
                              Source: unknownTCP traffic detected without corresponding DNS query: 142.250.65.200
                              Source: unknownTCP traffic detected without corresponding DNS query: 172.183.192.109
                              Source: unknownTCP traffic detected without corresponding DNS query: 142.250.65.200
                              Source: unknownTCP traffic detected without corresponding DNS query: 142.250.65.200
                              Source: unknownTCP traffic detected without corresponding DNS query: 142.250.65.200
                              Source: unknownTCP traffic detected without corresponding DNS query: 142.250.65.200
                              Source: unknownTCP traffic detected without corresponding DNS query: 142.250.65.200
                              Source: unknownTCP traffic detected without corresponding DNS query: 142.250.65.200
                              Source: unknownTCP traffic detected without corresponding DNS query: 142.250.65.200
                              Source: unknownTCP traffic detected without corresponding DNS query: 142.250.65.200
                              Source: unknownTCP traffic detected without corresponding DNS query: 172.183.192.109
                              Source: unknownTCP traffic detected without corresponding DNS query: 172.183.192.109
                              Source: unknownTCP traffic detected without corresponding DNS query: 172.183.192.109
                              Source: unknownTCP traffic detected without corresponding DNS query: 172.183.192.109
                              Source: unknownTCP traffic detected without corresponding DNS query: 142.250.65.200
                              Source: global trafficHTTP traffic detected: GET /f/AVG_AV/images/1509/EN.png HTTP/1.1Connection: Keep-AliveUser-Agent: Inno Setup 6.1.2Host: d11iilsblp9z11.cloudfront.net
                              Source: global trafficHTTP traffic detected: GET /f/BitComet/1548_Updated/BitComet_2.08a_setup.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Inno Setup 6.1.2Host: d11iilsblp9z11.cloudfront.net
                              Source: global trafficHTTP traffic detected: GET /f/WebAdvisor/files/1489/saBSI.zip HTTP/1.1Connection: Keep-AliveUser-Agent: Inno Setup 6.1.2Host: d11iilsblp9z11.cloudfront.net
                              Source: global trafficHTTP traffic detected: GET /f/AVG_AV/files/1319/avg.zip HTTP/1.1Connection: Keep-AliveUser-Agent: Inno Setup 6.1.2Host: d11iilsblp9z11.cloudfront.net
                              Source: global trafficHTTP traffic detected: GET /client/bitcomet/?ver=2.08&intl=en_us&osintl=jv&cid=ae7b79c1d0de3420440a531a8fc59151&btcnt=0&httpcnt=0&p=x64&idt=20240718 HTTP/1.1Host: update.bitcomet.comConnection: closeAccept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
                              Source: global trafficHTTP traffic detected: GET /start/en_us/2.08/ HTTP/1.1Host: inside.bitcomet.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
                              Source: global trafficHTTP traffic detected: GET /client/bitcomet/?ver=2.08&intl=en_us&osintl=jv&cid=ae7b79c1d0de3420440a531a8fc59151&btcnt=0&httpcnt=0&p=x64&idt=20240718 HTTP/1.1Host: update.bitcomet.comConnection: closeAccept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
                              Source: global trafficHTTP traffic detected: GET /client/bitcomet/?ver=2.08&intl=en_us&osintl=jv&cid=ae7b79c1d0de3420440a531a8fc59151&btcnt=0&httpcnt=0&p=x64&idt=20240718 HTTP/1.1Host: update.bitcomet.comConnection: closeAccept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
                              Source: global trafficHTTP traffic detected: GET /client/bitcomet/?ver=2.08&intl=en_us&osintl=jv&cid=ae7b79c1d0de3420440a531a8fc59151&btcnt=0&httpcnt=0&p=x64&idt=20240718 HTTP/1.1Host: update.bitcomet.comConnection: closeAccept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
                              Source: global trafficHTTP traffic detected: GET /client/bitcomet/?ver=2.08&intl=en_us&osintl=jv&cid=ae7b79c1d0de3420440a531a8fc59151&btcnt=0&httpcnt=0&p=x64&idt=20240718 HTTP/1.1Host: update.bitcomet.comConnection: closeAccept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
                              Source: global trafficHTTP traffic detected: GET /?random=1&style=iframe HTTP/1.1Host: apphit.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://inside.bitcomet.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
                              Source: global trafficHTTP traffic detected: GET /app/veracrypt?style=iframe&link= HTTP/1.1Host: apphit.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://inside.bitcomet.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: XSRF-TOKEN=eyJpdiI6IllZdWd4SGgxeCtkeEZoazN3RlFWcVE9PSIsInZhbHVlIjoiUFRaT1VuWXNhNEtXZlluK1ZoR29qMXY5dDFpTTVXUWFkSXA2dGVtZ0llckxNZVNtVS9TcVNhK0ZnZWRFM2U4VnhJdDhBN0I5Y3ZMZTdXU2hTMXpGMzJrTjlsZGllQ1MzNEFWTTZLRUpTTnJTVU1kbmM0dytaT05pTzZITnpqblAiLCJtYWMiOiI1ODNkMmQ0Njk0NjhiMzE0ZWM0OWU5Y2RmOGRmMDI2ZDNkZTg4ZGY4NGMzZTQ1NGU1OTlmY2EwNGY2Yjk4ODZjIiwidGFnIjoiIn0%3D; apphit_session=eyJpdiI6IjNsamJxYVYza29BR0JyM2Z2ZzJvWWc9PSIsInZhbHVlIjoiWk9OQlZlditaSWxuVS9NVmVxRWtRQXVIcEtnam55VjZxdzFNMUxuMFVISjVYZEh6ZzRaZFBwK0dNR05hMXd6a0t6eWdiNDJDL2pPenpUTkJJUVgxMlRqN1cwMDVEcUJIYm4vSVNjckplM0w1RVArY3NsQm5NcnZvaDdDZFBBT1AiLCJtYWMiOiIyNjVkY2Y4MDQ2OWFlYjhhN2I3ODMwYTg3NjliM2YwODU0ZTIyN2QzNzM5ZGRlZGE3NmMxOTAxOTllZDY2MDU5IiwidGFnIjoiIn0%3D
                              Source: global trafficHTTP traffic detected: GET /css/app.css HTTP/1.1Host: apphit.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://apphit.com/app/veracrypt?style=iframe&link=Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: XSRF-TOKEN=eyJpdiI6IlRDUFdYME9ZcXBrM2hyNWNrYURDTEE9PSIsInZhbHVlIjoiQ2NPTmFwdzRQemwwOEQveERmMXBiYWJURnByZWljd1hKSEV0c1VSUWllQzZvSmRmdTJya05BSDREaVlEeVYxdWMrVEVUc2tGdS9GWUI1Vi8xYnJIZ2dHbzVLM1Bma3A1WXZzVzFsaTlFWHB5YUUxVE1sSUY5d0FxSGlOTWZNOGUiLCJtYWMiOiI5YjFkYmRlNmQxYWNmY2YwOGQ5NDIwNzFiYjg2MDIyMjUzZDJlOWI0ZmZlNmNkMGU3YjJiYmVhNzhiOTZmMzRmIiwidGFnIjoiIn0%3D; apphit_session=eyJpdiI6Imc0WmF2ZDFDMjR5YTJOWG9tWG1MOGc9PSIsInZhbHVlIjoiQzc1OE00bCtvZzVUeW01ajlrVllXMkVCRDBuc1B5bFJwSHRWUUZKME5PeVYrbkpjSHByeU1Va1FlQ0lENTM2LzdiV1BnNDJnWi9IMVRwc0laaFU5KzVFWCtmNmZtNVZtT3dKMHdnT3g1Q2NUWHh0TDRUK0NPT0ZMMEdNOUhlWmsiLCJtYWMiOiI0Mzc4ZjEzZGJkMzc1ZGQwYzhmNzMwYTlkNjBhOWY4MzE2MjdhOTI2OTYwODk5OGIzZjljYWU2NjViZTE0YWJjIiwidGFnIjoiIn0%3D
                              Source: global trafficHTTP traffic detected: GET /image/app/veracrypt/veracrypt-logo.svg HTTP/1.1Host: image.apphit.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://apphit.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
                              Source: global trafficHTTP traffic detected: GET /gtag/js?id=G-BE27VNW489 HTTP/1.1Host: www.googletagmanager.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://apphit.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
                              Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: apphit.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://apphit.com/app/veracrypt?style=iframe&link=Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: XSRF-TOKEN=eyJpdiI6IlRDUFdYME9ZcXBrM2hyNWNrYURDTEE9PSIsInZhbHVlIjoiQ2NPTmFwdzRQemwwOEQveERmMXBiYWJURnByZWljd1hKSEV0c1VSUWllQzZvSmRmdTJya05BSDREaVlEeVYxdWMrVEVUc2tGdS9GWUI1Vi8xYnJIZ2dHbzVLM1Bma3A1WXZzVzFsaTlFWHB5YUUxVE1sSUY5d0FxSGlOTWZNOGUiLCJtYWMiOiI5YjFkYmRlNmQxYWNmY2YwOGQ5NDIwNzFiYjg2MDIyMjUzZDJlOWI0ZmZlNmNkMGU3YjJiYmVhNzhiOTZmMzRmIiwidGFnIjoiIn0%3D; apphit_session=eyJpdiI6Imc0WmF2ZDFDMjR5YTJOWG9tWG1MOGc9PSIsInZhbHVlIjoiQzc1OE00bCtvZzVUeW01ajlrVllXMkVCRDBuc1B5bFJwSHRWUUZKME5PeVYrbkpjSHByeU1Va1FlQ0lENTM2LzdiV1BnNDJnWi9IMVRwc0laaFU5KzVFWCtmNmZtNVZtT3dKMHdnT3g1Q2NUWHh0TDRUK0NPT0ZMMEdNOUhlWmsiLCJtYWMiOiI0Mzc4ZjEzZGJkMzc1ZGQwYzhmNzMwYTlkNjBhOWY4MzE2MjdhOTI2OTYwODk5OGIzZjljYWU2NjViZTE0YWJjIiwidGFnIjoiIn0%3D
                              Source: global trafficHTTP traffic detected: GET /images/favicon.png HTTP/1.1Host: apphit.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://apphit.com/app/veracrypt?style=iframe&link=Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: XSRF-TOKEN=eyJpdiI6IlRDUFdYME9ZcXBrM2hyNWNrYURDTEE9PSIsInZhbHVlIjoiQ2NPTmFwdzRQemwwOEQveERmMXBiYWJURnByZWljd1hKSEV0c1VSUWllQzZvSmRmdTJya05BSDREaVlEeVYxdWMrVEVUc2tGdS9GWUI1Vi8xYnJIZ2dHbzVLM1Bma3A1WXZzVzFsaTlFWHB5YUUxVE1sSUY5d0FxSGlOTWZNOGUiLCJtYWMiOiI5YjFkYmRlNmQxYWNmY2YwOGQ5NDIwNzFiYjg2MDIyMjUzZDJlOWI0ZmZlNmNkMGU3YjJiYmVhNzhiOTZmMzRmIiwidGFnIjoiIn0%3D; apphit_session=eyJpdiI6Imc0WmF2ZDFDMjR5YTJOWG9tWG1MOGc9PSIsInZhbHVlIjoiQzc1OE00bCtvZzVUeW01ajlrVllXMkVCRDBuc1B5bFJwSHRWUUZKME5PeVYrbkpjSHByeU1Va1FlQ0lENTM2LzdiV1BnNDJnWi9IMVRwc0laaFU5KzVFWCtmNmZtNVZtT3dKMHdnT3g1Q2NUWHh0TDRUK0NPT0ZMMEdNOUhlWmsiLCJtYWMiOiI0Mzc4ZjEzZGJkMzc1ZGQwYzhmNzMwYTlkNjBhOWY4MzE2MjdhOTI2OTYwODk5OGIzZjljYWU2NjViZTE0YWJjIiwidGFnIjoiIn0%3D
                              Source: global trafficHTTP traffic detected: GET /?p_age=0&p_bld=mmm_irs_ppi_902_451_o&p_cpua=x64&p_edi=15&p_icar=1&p_lng=en&p_midex=3F5C7CD44D1F6AC769934CADA267B4DF43CEF16EBFB411D103FDD4B0F14B185F&p_ost=0&p_osv=10.0&p_pro=111&p_prod=avg-av&p_ram=8191&p_vbd=9241&p_vep=24&p_ves=6&p_vre=1898&repoid=release& HTTP/1.1Host: shepherd.avcdn.netUser-Agent: libcurl/8.7.0-DEV Schannel zlib/1.3.1 c-ares/1.28.1 nghttp2/1.48.0Accept: */*Accept-Encoding: deflate, gzip
                              Source: global trafficHTTP traffic detected: GET /?p_age=0&p_bld=mmm_irs_ppi_902_451_o&p_cpua=x64&p_icar=1&p_lng=en&p_midex=3F5C7CD44D1F6AC769934CADA267B4DF43CEF16EBFB411D103FDD4B0F14B185F&p_ost=0&p_osv=10.0&p_pro=111&p_prod=avg-av-vps&p_ram=8191&p_vbd=1806&p_vep=24&p_ves=7&p_vre=6883&repoid=release& HTTP/1.1Host: shepherd.avcdn.netUser-Agent: libcurl/8.7.0-DEV Schannel zlib/1.3.1 c-ares/1.28.1 nghttp2/1.48.0Accept: */*Accept-Encoding: deflate, gzip
                              Source: global trafficDNS traffic detected: DNS query: d11iilsblp9z11.cloudfront.net
                              Source: global trafficDNS traffic detected: DNS query: www.bitcomet.com
                              Source: global trafficDNS traffic detected: DNS query: analytics.apis.mcafee.com
                              Source: global trafficDNS traffic detected: DNS query: honzik.avcdn.net
                              Source: global trafficDNS traffic detected: DNS query: v7event.stats.avast.com
                              Source: global trafficDNS traffic detected: DNS query: sadownload.mcafee.com
                              Source: global trafficDNS traffic detected: DNS query: analytics.avcdn.net
                              Source: global trafficDNS traffic detected: DNS query: router.bittorrent.com
                              Source: global trafficDNS traffic detected: DNS query: router.utorrent.com
                              Source: global trafficDNS traffic detected: DNS query: dht.transmissionbt.com
                              Source: global trafficDNS traffic detected: DNS query: router.silotis.us
                              Source: global trafficDNS traffic detected: DNS query: dht.libtorrent.org
                              Source: global trafficDNS traffic detected: DNS query: update.bitcomet.com
                              Source: global trafficDNS traffic detected: DNS query: inside.bitcomet.com
                              Source: global trafficDNS traffic detected: DNS query: apphit.com
                              Source: global trafficDNS traffic detected: DNS query: appassets.bitcomet.com
                              Source: global trafficDNS traffic detected: DNS query: chrome.cloudflare-dns.com
                              Source: global trafficDNS traffic detected: DNS query: shepherd.avcdn.net
                              Source: unknownHTTP traffic detected: POST /o HTTP/1.1Connection: Keep-AliveContent-Type: application/json; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 122Host: d11iilsblp9z11.cloudfront.net
                              Source: BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.000000000276B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: ftp://http://%.20s%ddefault%d%.20scopying
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2504355859.0000000006006000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://%s:%d;https=https://%s:%dHTTP/1.0
                              Source: BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmp, BitComet_2.08a_setup.exe, 00000005.00000003.2216838446.00000000030F3000.00000004.00000020.00020000.00000000.sdmp, BitCometService.exe, 00000007.00000000.2219056808.0000000000596000.00000002.00000001.01000000.00000011.sdmp, BitCometService.exe, 00000007.00000002.2220151186.0000000000596000.00000002.00000001.01000000.00000011.sdmp, BitComet.exe, 0000000D.00000002.2420857876.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmp, BitComet.exe, 0000000D.00000000.2403166450.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmpString found in binary or memory: http://.css
                              Source: BitComet.exe, 0000000D.00000002.2420857876.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmp, BitComet.exe, 0000000D.00000000.2403166450.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmpString found in binary or memory: http://.flvftp://https://flashget://thunder://
                              Source: BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmp, BitComet_2.08a_setup.exe, 00000005.00000003.2216838446.00000000030F3000.00000004.00000020.00020000.00000000.sdmp, BitCometService.exe, 00000007.00000000.2219056808.0000000000596000.00000002.00000001.01000000.00000011.sdmp, BitCometService.exe, 00000007.00000002.2220151186.0000000000596000.00000002.00000001.01000000.00000011.sdmp, BitComet.exe, 0000000D.00000002.2420857876.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmp, BitComet.exe, 0000000D.00000000.2403166450.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmpString found in binary or memory: http://.jpg
                              Source: BitComet.exe, 0000000D.00000002.2420857876.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmp, BitComet.exe, 0000000D.00000000.2403166450.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmpString found in binary or memory: http://127.0.0.1
                              Source: BitComet.exe, 0000000D.00000002.2420857876.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmp, BitComet.exe, 0000000D.00000000.2403166450.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmpString found in binary or memory: http://127.0.0.1/data
                              Source: BitComet.exe, 0000000D.00000002.2420857876.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmp, BitComet.exe, 0000000D.00000000.2403166450.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmpString found in binary or memory: http://127.0.0.1Note:
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2344093536.0000000004F1E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2359323053.0000000006345000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2362643784.0000000004F1A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2640404184.0000000006340000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000002.2901166157.00000000056F3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2734027576.00000000054BB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720973329.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2733043815.00000000054BA000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2729383650.000000000544A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2721125963.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2731341920.000000000544A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2733544200.00000000057F4000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2717611623.00000000054EE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2733919705.00000000056F3000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000B.00000003.2388892493.0000000004E69000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000B.00000003.2388808034.0000000004E58000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2450616405.0000000005E8C000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000002.2995522970.0000000005490000.00000002.00000001.00040000.00000018.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2504355859.0000000006006000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2539291834.0000000005D30000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2577221124.0000000005DA0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2362643784.0000000004F1A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2640404184.0000000006340000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000B.00000003.2388892493.0000000004E69000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000B.00000003.2388808034.0000000004E58000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2450616405.0000000005E8C000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000002.2995522970.0000000005490000.00000002.00000001.00040000.00000018.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2504355859.0000000006006000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2539291834.0000000005D30000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2577221124.0000000005DA0000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2418861617.0000000005B49000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2344093536.0000000004F1E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2359323053.0000000006345000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2362643784.0000000004F1A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2640404184.0000000006340000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2883408378.0000000005448000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000002.2901068864.00000000056B0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2733043815.00000000054BA000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2717611623.00000000054EE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2733919705.00000000056F3000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000B.00000003.2388892493.0000000004E69000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000B.00000003.2388808034.0000000004E58000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2450616405.0000000005E8C000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000002.2995522970.0000000005490000.00000002.00000001.00040000.00000018.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2504355859.0000000006006000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2539291834.0000000005D30000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2577221124.0000000005DA0000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2418861617.0000000005B49000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2344093536.0000000004F1E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2359323053.0000000006345000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2362643784.0000000004F1A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2640404184.0000000006340000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000002.2901166157.00000000056F3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2734027576.00000000054BB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000002.2901068864.00000000056B0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720973329.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2733043815.00000000054BA000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2737216588.00000000054BB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2729383650.000000000544A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2721125963.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2731341920.000000000544A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2717611623.00000000054EE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2733919705.00000000056F3000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000B.00000003.2388892493.0000000004E69000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000B.00000003.2388808034.0000000004E58000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2450616405.0000000005E8C000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000002.2995522970.0000000005490000.00000002.00000001.00040000.00000018.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2504355859.0000000006006000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2539291834.0000000005D30000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
                              Source: BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ccsca2021.crl.certum.pl/ccsca2021.crl0s
                              Source: BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ccsca2021.ocsp-certum.com05
                              Source: saBSI.exe, saBSI.exe, 0000000A.00000002.2897708570.0000000002E64000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000000.2344892193.00000000006DE000.00000002.00000001.01000000.00000016.sdmp, saBSI.exe, 0000000A.00000002.2897708570.0000000002E4E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmp, saBSI.exe, 0000000A.00000003.2896422358.0000000002E63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://clients2.google.com/service/update2/crx
                              Source: saBSI.exe, 0000000A.00000002.2897708570.0000000002E64000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2896422358.0000000002E63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://clients2.google.com/service/update2/crx4
                              Source: saBSI.exe, 0000000A.00000002.2897708570.0000000002E64000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2896422358.0000000002E63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://clients2.google.com/service/update2/crxm
                              Source: BitComet.exe, 0000000D.00000000.2403166450.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmpString found in binary or memory: http://cn.bitcomet.com/achive/BitComet_1.20_setup.exe
                              Source: BitComet.exe, 0000000D.00000002.2420857876.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmp, BitComet.exe, 0000000D.00000000.2403166450.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmpString found in binary or memory: http://cn.bitcomet.com/achive/BitComet_1.20_setup.exemirror
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2628849428.0000000005C36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cnx.conceptsheartranch.com/
                              Source: BitComet.exe, 0000000D.00000003.2405439939.0000023E831E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://code.google.com/p/crashrpt/wiki/FAQ
                              Source: BitComet.exe, 0000000D.00000002.2420857876.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmp, BitComet.exe, 0000000D.00000000.2403166450.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmpString found in binary or memory: http://crashfix.bitcomet.com/crashfix/index.php/crashReport/uploadExternalhttps://www.bitcomet.com/e
                              Source: BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmp, BitComet_2.08a_setup.exe, 00000005.00000003.2216838446.00000000030F3000.00000004.00000020.00020000.00000000.sdmp, BitComet.exe, 0000000D.00000003.2405439939.0000023E833A5000.00000004.00001000.00020000.00000000.sdmp, BitComet.exe, 0000000E.00000003.2413441796.0000021F09335000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.certum.pl/cscasha2.crl0q
                              Source: BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmp, BitComet_2.08a_setup.exe, 00000005.00000003.2216838446.00000000030F3000.00000004.00000020.00020000.00000000.sdmp, BitComet.exe, 0000000D.00000003.2405439939.0000023E833A5000.00000004.00001000.00020000.00000000.sdmp, BitComet.exe, 0000000E.00000003.2413441796.0000021F09335000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.certum.pl/ctnca.crl0k
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110344218.0000000004EDD000.00000004.00000020.00020000.00000000.sdmp, BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmp, BitComet_2.08a_setup.exe, 00000005.00000003.2216838446.00000000030F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.certum.pl/ctnca2.crl0l
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110344218.0000000004EDD000.00000004.00000020.00020000.00000000.sdmp, BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmp, BitComet_2.08a_setup.exe, 00000005.00000003.2216838446.00000000030F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.certum.pl/ctsca2021.crl0o
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2344093536.0000000004F1E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2359323053.0000000006345000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2731341920.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2884883686.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2731341920.0000000005421000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2729383650.000000000544A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2729383650.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2731341920.000000000544A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002EE3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2717611623.00000000054EE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2733919705.00000000056F3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2718431117.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002EE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2344093536.0000000004F1E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2359323053.0000000006345000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2874180498.00000000057B6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2731341920.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2729383650.000000000544A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720457018.000000000540E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2729383650.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2731341920.000000000544A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000002.2901328913.00000000057B6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002EE3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2717611623.00000000054EE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2733919705.00000000056F3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2718431117.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002EE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2344093536.0000000004F1E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2359323053.0000000006345000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2362643784.0000000004F1A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2640404184.0000000006340000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000002.2901166157.00000000056F3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2734027576.00000000054BB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720973329.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2733043815.00000000054BA000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2729383650.000000000544A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2721125963.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2731341920.000000000544A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2733544200.00000000057F4000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2717611623.00000000054EE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2733919705.00000000056F3000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000B.00000003.2388892493.0000000004E69000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000B.00000003.2388808034.0000000004E58000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2450616405.0000000005E8C000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000002.2995522970.0000000005490000.00000002.00000001.00040000.00000018.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2504355859.0000000006006000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2539291834.0000000005D30000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2577221124.0000000005DA0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2362643784.0000000004F1A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2640404184.0000000006340000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000B.00000003.2388892493.0000000004E69000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000B.00000003.2388808034.0000000004E58000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2450616405.0000000005E8C000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000002.2995522970.0000000005490000.00000002.00000001.00040000.00000018.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2504355859.0000000006006000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2539291834.0000000005D30000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2577221124.0000000005DA0000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2418861617.0000000005B49000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2344093536.0000000004F1E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2359323053.0000000006345000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2362643784.0000000004F1A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2640404184.0000000006340000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2883408378.0000000005448000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000002.2901068864.00000000056B0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2733043815.00000000054BA000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2717611623.00000000054EE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2733919705.00000000056F3000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000B.00000003.2388892493.0000000004E69000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000B.00000003.2388808034.0000000004E58000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2450616405.0000000005E8C000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000002.2995522970.0000000005490000.00000002.00000001.00040000.00000018.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2504355859.0000000006006000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2539291834.0000000005D30000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2577221124.0000000005DA0000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2418861617.0000000005B49000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2418861617.0000000005B49000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2362643784.0000000004F1A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2640404184.0000000006340000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000B.00000003.2388892493.0000000004E69000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000B.00000003.2388808034.0000000004E58000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2450616405.0000000005E8C000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000002.2995522970.0000000005490000.00000002.00000001.00040000.00000018.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2504355859.0000000006006000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2539291834.0000000005D30000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2577221124.0000000005DA0000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2418861617.0000000005B49000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
                              Source: msedgewebview2.exe, 00000021.00000003.2532289125.00003D28006AC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crrev.com/c/2555698.
                              Source: BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmp, BitComet_2.08a_setup.exe, 00000005.00000003.2216838446.00000000030F3000.00000004.00000020.00020000.00000000.sdmp, BitComet.exe, 0000000D.00000003.2405439939.0000023E833A5000.00000004.00001000.00020000.00000000.sdmp, BitComet.exe, 0000000E.00000003.2413441796.0000021F09335000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cscasha2.ocsp-certum.com04
                              Source: saBSI.exe, 0000000A.00000002.2897708570.0000000002EE3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2896027780.0000000002EE3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002EE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
                              Source: saBSI.exe, 0000000A.00000002.2897708570.0000000002EE3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2896027780.0000000002EE3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002EE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2628849428.0000000005C36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://doubleclick-proxy.ff.avast.com/v1/gclid
                              Source: BitComet.exe, 0000000D.00000000.2403166450.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmpString found in binary or memory: http://download.bitcomet.com/bitcomet/bitcomet_setup.exe
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2628849428.0000000005C36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gf.tools.avast.com/tools/gf/
                              Source: BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.000000000276B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.atcomet.com/b/
                              Source: BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmp, BitComet_2.08a_setup.exe, 00000005.00000003.2216838446.00000000030F3000.00000004.00000020.00020000.00000000.sdmp, BitCometService.exe, 00000007.00000000.2219056808.0000000000596000.00000002.00000001.01000000.00000011.sdmp, BitCometService.exe, 00000007.00000002.2220151186.0000000000596000.00000002.00000001.01000000.00000011.sdmp, BitComet.exe, 0000000D.00000002.2420857876.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmp, BitComet.exe, 0000000D.00000000.2403166450.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmpString found in binary or memory: http://html4/loose.dtd
                              Source: avg_antivirus_free_setup.exe, 0000000B.00000000.2364390202.00000000000C3000.00000002.00000001.01000000.00000017.sdmp, avg_antivirus_free_setup.exe, 0000000B.00000002.2963084059.00000000000C3000.00000002.00000001.01000000.00000017.sdmpString found in binary or memory: http://https://:allow_fallback/installer.exe
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2628849428.0000000005C36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://median-a1.iavs9x.u.avast.com/iavs9x/avast_one_essential_setup_online.exe
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2628849428.0000000005C36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://median-free.iavs9x.u.avast.com/iavs9x/avast_free_antivirus_setup_online.exe
                              Source: BitComet.exe, 0000000D.00000002.2420857876.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmp, BitComet.exe, 0000000D.00000000.2403166450.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmpString found in binary or memory: http://mirror.com/pub/
                              Source: BitComet.exe, 0000000D.00000002.2420857876.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmp, BitComet.exe, 0000000D.00000000.2403166450.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmpString found in binary or memory: http://mirror.com/pub/file.exe
                              Source: BitComet.exe, 0000000D.00000002.2420857876.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmp, BitComet.exe, 0000000D.00000000.2403166450.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmpString found in binary or memory: http://mirror.com/pub/folder_name/file1.exe
                              Source: BitComet.exe, 0000000D.00000002.2420857876.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmp, BitComet.exe, 0000000D.00000000.2403166450.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmpString found in binary or memory: http://mirror.com/pub/folder_name/file2.exe
                              Source: BitComet_2.08a_setup.exe, 00000005.00000000.2148208697.000000000040A000.00000008.00000001.01000000.0000000D.sdmp, BitComet_2.08a_setup.exe, 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmp, BitComet_2.08a_setup.exe, 00000005.00000003.2221676510.00000000037CB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
                              Source: BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2362643784.0000000004F1A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2640404184.0000000006340000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000B.00000003.2388892493.0000000004E69000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000B.00000003.2388808034.0000000004E58000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2450616405.0000000005E8C000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000002.2995522970.0000000005490000.00000002.00000001.00040000.00000018.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2504355859.0000000006006000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2539291834.0000000005D30000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2577221124.0000000005DA0000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2418861617.0000000005B49000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2344093536.0000000004F1E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2359323053.0000000006345000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2362643784.0000000004F1A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2640404184.0000000006340000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000002.2901166157.00000000056F3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2734027576.00000000054BB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000002.2901068864.00000000056B0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720973329.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2733043815.00000000054BA000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2737216588.00000000054BB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2729383650.000000000544A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2721125963.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2731341920.000000000544A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2717611623.00000000054EE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2733919705.00000000056F3000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000B.00000003.2388892493.0000000004E69000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000B.00000003.2388808034.0000000004E58000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2450616405.0000000005E8C000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000002.2995522970.0000000005490000.00000002.00000001.00040000.00000018.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2504355859.0000000006006000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2539291834.0000000005D30000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2344093536.0000000004F1E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2359323053.0000000006345000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2362643784.0000000004F1A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2640404184.0000000006340000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000002.2901166157.00000000056F3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2734027576.00000000054BB000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720973329.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2733043815.00000000054BA000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2729383650.000000000544A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2721125963.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2731341920.000000000544A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2733544200.00000000057F4000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2717611623.00000000054EE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2733919705.00000000056F3000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000B.00000003.2388892493.0000000004E69000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000B.00000003.2388808034.0000000004E58000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2450616405.0000000005E8C000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000002.2995522970.0000000005490000.00000002.00000001.00040000.00000018.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2504355859.0000000006006000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2539291834.0000000005D30000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2577221124.0000000005DA0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2344093536.0000000004F1E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2359323053.0000000006345000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2362643784.0000000004F1A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2640404184.0000000006340000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2883408378.0000000005448000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000002.2901068864.00000000056B0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2733043815.00000000054BA000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2717611623.00000000054EE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2733919705.00000000056F3000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000B.00000003.2388892493.0000000004E69000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000B.00000003.2388808034.0000000004E58000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2450616405.0000000005E8C000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000002.2995522970.0000000005490000.00000002.00000001.00040000.00000018.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2504355859.0000000006006000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2539291834.0000000005D30000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2577221124.0000000005DA0000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2418861617.0000000005B49000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2344093536.0000000004F1E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2359323053.0000000006345000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2731341920.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2731341920.0000000005421000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2729383650.000000000544A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2729383650.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2731341920.000000000544A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002EE3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2717611623.00000000054EE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2733919705.00000000056F3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2718431117.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002EE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2344093536.0000000004F1E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2359323053.0000000006345000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2874180498.00000000057B6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2731341920.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2729383650.000000000544A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720457018.000000000540E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2729383650.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2731341920.000000000544A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000002.2901328913.00000000057B6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002EE3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2717611623.00000000054EE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2733919705.00000000056F3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2718431117.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002EE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2628849428.0000000005C36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://push.ff.avast.com
                              Source: BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.certum.pl/ccsca2021.cer0
                              Source: BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmp, BitComet_2.08a_setup.exe, 00000005.00000003.2216838446.00000000030F3000.00000004.00000020.00020000.00000000.sdmp, BitComet.exe, 0000000D.00000003.2405439939.0000023E833A5000.00000004.00001000.00020000.00000000.sdmp, BitComet.exe, 0000000E.00000003.2413441796.0000021F09335000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://repository.certum.pl/cscasha2.cer0
                              Source: BitComet.exe, 0000000D.00000003.2405439939.0000023E833A5000.00000004.00001000.00020000.00000000.sdmp, BitComet.exe, 0000000E.00000003.2413441796.0000021F09335000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://repository.certum.pl/ctnca.cer0
                              Source: BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmp, BitComet_2.08a_setup.exe, 00000005.00000003.2216838446.00000000030F3000.00000004.00000020.00020000.00000000.sdmp, BitComet.exe, 0000000D.00000003.2405439939.0000023E833A5000.00000004.00001000.00020000.00000000.sdmp, BitComet.exe, 0000000E.00000003.2413441796.0000021F09335000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://repository.certum.pl/ctnca.cer09
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110344218.0000000004EDD000.00000004.00000020.00020000.00000000.sdmp, BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmp, BitComet_2.08a_setup.exe, 00000005.00000003.2216838446.00000000030F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.certum.pl/ctnca2.cer09
                              Source: BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmp, BitComet_2.08a_setup.exe, 00000005.00000003.2216838446.00000000030F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.certum.pl/ctsca2021.cer0
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110344218.0000000004EDD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.certum.pl/ctsca2021.cer0A
                              Source: saBSI.exe, 0000000A.00000003.2730262487.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2730852804.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002F1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://secure.globalsign.com/
                              Source: saBSI.exe, 0000000A.00000003.2730262487.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2730852804.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002F1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://secure.globalsign.com/W
                              Source: saBSI.exe, 0000000A.00000003.2730262487.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2730852804.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002EB9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2344093536.0000000004F1E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2359323053.0000000006345000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2731341920.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2731341920.0000000005421000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2729383650.000000000544A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2729383650.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2731341920.000000000544A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002EE3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2717611623.00000000054EE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2733919705.00000000056F3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2718431117.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002EE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2344093536.0000000004F1E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2359323053.0000000006345000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2874180498.00000000057B6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2731341920.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2729383650.000000000544A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720457018.000000000540E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2729383650.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2731341920.000000000544A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000002.2901328913.00000000057B6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002EE3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2717611623.00000000054EE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2733919705.00000000056F3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2718431117.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002EE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
                              Source: saBSI.exe, 0000000A.00000003.2728067926.0000000002EE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://secure.globalsign.com:80/cacert/codesigningrootr45.crt
                              Source: BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmp, BitComet_2.08a_setup.exe, 00000005.00000003.2216838446.00000000030F3000.00000004.00000020.00020000.00000000.sdmp, BitComet.exe, 0000000D.00000003.2405439939.0000023E833A5000.00000004.00001000.00020000.00000000.sdmp, BitComet.exe, 0000000E.00000003.2413441796.0000021F09335000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://subca.ocsp-certum.com01
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110344218.0000000004EDD000.00000004.00000020.00020000.00000000.sdmp, BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmp, BitComet_2.08a_setup.exe, 00000005.00000003.2216838446.00000000030F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://subca.ocsp-certum.com02
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110344218.0000000004EDD000.00000004.00000020.00020000.00000000.sdmp, BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmp, BitComet_2.08a_setup.exe, 00000005.00000003.2216838446.00000000030F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://subca.ocsp-certum.com05
                              Source: BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://submit.fileshot.net/put/
                              Source: BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://submit.fileshot.net/put/file_hashfile_sizefile_indexpic_indexvideo_durationvideo_resolution_x
                              Source: BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://submit.fileshot.net/query/
                              Source: BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://submit.fileshot.net/query/POST3api_versionvl_hashfile_size
                              Source: BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://submit.fileshot.net/torrent/
                              Source: BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://submit.fileshot.net/torrent/info_hashsize_index
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2628849428.0000000005C36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://submit.sb.avast.com/V1/MD/
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2628849428.0000000005C36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://submit.sb.avast.com/V1/PD/
                              Source: avg_antivirus_free_setup.exe, 0000000B.00000002.2971743307.0000000004DB8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://v7event.stats.avast.com/
                              Source: avg_antivirus_free_setup.exe, 0000000B.00000002.2971743307.0000000004DFA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://v7event.stats.avast.com/JH
                              Source: avg_antivirus_free_setup.exe, 0000000B.00000003.2391365686.0000000004E30000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000B.00000002.2976222461.0000000004E30000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://v7event.stats.avast.com/cgi-bin/iavsevents.cgi
                              Source: avg_antivirus_free_setup.exe, 0000000B.00000003.2391365686.0000000004E30000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000B.00000002.2976222461.0000000004E30000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://v7event.stats.avast.com/cgi-bin/iavsevents.cgiC
                              Source: avg_antivirus_free_setup.exe, 0000000B.00000003.2391365686.0000000004E30000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000B.00000002.2976222461.0000000004E30000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://v7event.stats.avast.com:80/cgi-bin/iavsevents.cgi
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2628849428.0000000005C36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wtu.d.avcdn.net/avg/wtu/95b029cd737ea13a32d791d4e211fde568448486e62646a07992c7e57969ecf0/WTUI
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2628849428.0000000005C36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wtu.d.avcdn.net/avg/wtu/95b029cd737ea13a32d791d4e211fde568448486e62646a07992c7e57969ecf0/wtu.
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2362643784.0000000004F1A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2640404184.0000000006340000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000B.00000003.2388892493.0000000004E69000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000B.00000003.2388808034.0000000004E58000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2450616405.0000000005E8C000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000002.2995522970.0000000005490000.00000002.00000001.00040000.00000018.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2504355859.0000000006006000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2539291834.0000000005D30000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2577221124.0000000005DA0000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2418861617.0000000005B49000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.avast.com0/
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110344218.0000000004EDD000.00000004.00000020.00020000.00000000.sdmp, BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmp, BitComet_2.08a_setup.exe, 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmp, BitComet_2.08a_setup.exe, 00000005.00000003.2216838446.00000000030F3000.00000004.00000020.00020000.00000000.sdmp, BitComet.exe, 0000000D.00000003.2405439939.0000023E833A5000.00000004.00001000.00020000.00000000.sdmp, BitComet.exe, 0000000E.00000003.2413441796.0000021F09335000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.bitcomet.com
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2633853589.0000000004EA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2627572791.0000000003622000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2642171583.00000000074E9000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2622264821.0000000002390000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1703819395.0000000003490000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.bitcomet.com/doc/term-of-use.php
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2617899539.00000000007BF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.bitcomet.com/doc/term-of-use.phprSj:
                              Source: BitComet_2.08a_setup.exe, 00000005.00000002.2247774329.0000000000832000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.bitcomet.com/http://www.bitcomet.com/index-zh.htmHomePage
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110344218.0000000004EDD000.00000004.00000020.00020000.00000000.sdmp, BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmp, BitComet_2.08a_setup.exe, 00000005.00000003.2216838446.00000000030F3000.00000004.00000020.00020000.00000000.sdmp, BitComet.exe, 0000000D.00000003.2405439939.0000023E833A5000.00000004.00001000.00020000.00000000.sdmp, BitComet.exe, 0000000E.00000003.2413441796.0000021F09335000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.certum.pl/CPS0
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2362643784.0000000004F1A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2640404184.0000000006340000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000B.00000003.2388892493.0000000004E69000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000B.00000003.2388808034.0000000004E58000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2450616405.0000000005E8C000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000002.2995522970.0000000005490000.00000002.00000001.00040000.00000018.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2504355859.0000000006006000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2539291834.0000000005D30000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2577221124.0000000005DA0000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2418861617.0000000005B49000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe, 00000000.00000003.2649478318.0000000002216000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe, 00000000.00000003.1695476894.0000000002570000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2642171583.00000000075B6000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1703819395.0000000003490000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.dk-soft.org/
                              Source: avg_antivirus_free_setup.exe, 0000000B.00000002.2976222461.0000000004E30000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google-analytics.com/
                              Source: avg_antivirus_free_setup.exe, 0000000B.00000003.2391365686.0000000004E30000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000B.00000002.2976222461.0000000004E30000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google-analytics.com/C
                              Source: avg_antivirus_free_setup.exe, 0000000B.00000003.2391365686.0000000004E30000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000B.00000002.2976222461.0000000004E30000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000B.00000002.2971743307.0000000004DDB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google-analytics.com/collect
                              Source: avg_antivirus_free_setup.exe, 0000000B.00000003.2391365686.0000000004E30000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000B.00000002.2976222461.0000000004E30000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google-analytics.com:80/collect.
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2344093536.0000000004F1E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2359323053.0000000006345000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2883408378.0000000005448000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000002.2901068864.00000000056B0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2895072615.0000000002E8D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2729383650.000000000544A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000002.2901224805.0000000005735000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2731341920.000000000544A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000002.2897708570.0000000002E8D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2717611623.00000000054EE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2733919705.00000000056F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.mcafee.com
                              Source: BitComet.exe, 0000000D.00000003.2405439939.0000023E831E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.winimage.com/zLibDll
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2504355859.0000000006006000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.winimage.com/zLibDllDELETEPUTCONNECTTRACECOPYLOCKMKCOLMOVEPROPFINDPROPPATCHSEARCHUNLOCKBI
                              Source: BitComet.exe, 0000000D.00000002.2420857876.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmp, BitComet.exe, 0000000D.00000000.2403166450.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmp, BitComet.exe, 0000000E.00000000.2411594882.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmpString found in binary or memory: http://www.wxwidgets.org
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2450616405.0000000005E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://://:http://.cgtt
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2628849428.0000000005C36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/3517838/avg_online_security-latest.xpi?src=externa
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2628849428.0000000005C36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://addons.opera.com/extensions/details/avg-online-security
                              Source: saBSI.exe, 0000000A.00000003.2895072615.0000000002EB9000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2373312406.0000000002EE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.apis.mcafee.com/
                              Source: saBSI.exe, 0000000A.00000002.2897708570.0000000002E81000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002EE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.apis.mcafee.com/mosaic/2.0/product-web/am/v1/record
                              Source: saBSI.exe, 0000000A.00000002.2897708570.0000000002EB9000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2895072615.0000000002EB9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.apis.mcafee.com/mosaic/2.0/product-web/am/v1/record=
                              Source: saBSI.exe, 0000000A.00000003.2884586261.0000000005405000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000002.2900191307.0000000005405000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2486584163.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2884328927.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2718431117.0000000005404000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.apis.mcafee.com/mosaic/2.0/product-web/am/v1/recorder
                              Source: saBSI.exe, 0000000A.00000002.2900191307.0000000005405000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.apis.mcafee.com/mosaic/2.0/product-web/am/v1/recorderK
                              Source: saBSI.exe, 0000000A.00000002.2897708570.0000000002EB9000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2895072615.0000000002EB9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.apis.mcafee.com/mosaic/2.0/product-web/am/v1/recordm
                              Source: saBSI.exe, 0000000A.00000003.2895072615.0000000002E81000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000002.2897708570.0000000002E81000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.apis.mcafee.com/x
                              Source: saBSI.exe, 0000000A.00000002.2897708570.0000000002EE3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2896027780.0000000002EE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.apis.mcafee.com:443/mosaic/2.0/product-web/am/v1/record
                              Source: saBSI.exe, 0000000A.00000003.2719167639.0000000002EE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.apis.mcafee.com:443/mosaic/2.0/product-web/am/v1/recordY_DIST_AFFID_LIST
                              Source: saBSI.exe, 0000000A.00000003.2373312406.0000000002E8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.apis.mcafee.com:443/mosaic/2.0/product-web/am/v1/recordytics.apis.mcafee.com/mosai
                              Source: saBSI.exe, 0000000A.00000000.2344892193.00000000006DE000.00000002.00000001.01000000.00000016.sdmp, saBSI.exe, 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://analytics.apis.mcafee.comhttps://analytics.qa.apis.mcafee.com/mosaic/2.0/product-web/am/v1/r
                              Source: saBSI.exe, 0000000A.00000002.2897708570.0000000002E64000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2896422358.0000000002E63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.apis.mcafee.comse
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2418508115.000000000356A000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2631626247.0000000003565000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2405702362.000000000358A000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2496843336.000000000356B000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2405758044.000000000356C000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2419762782.000000000358A000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2403613513.000000000356C000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2536687235.0000000003565000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2547902689.000000000356A000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2417641679.0000000003565000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2571577024.000000000356B000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2514522947.000000000356B000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2417641679.0000000003571000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2632392796.000000000356A000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2546498050.0000000003565000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2447801969.0000000003571000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2454099658.000000000356A000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000002.2976217934.0000000003565000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2574209553.000000000356B000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000002.2976217934.0000000003571000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2610630444.000000000356B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.avcdn.net/
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2405758044.0000000003571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.avcdn.net/v4/receive/json/25
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000002.2976217934.0000000003544000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.avcdn.net/v4/receive/json/25%
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000002.2976217934.0000000003571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.avcdn.net/v4/receive/json/25:7
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000002.2995522970.0000000005490000.00000002.00000001.00040000.00000018.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000000.2390280020.0000000000DC7000.00000002.00000001.01000000.00000018.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000002.2964747983.0000000000DC7000.00000002.00000001.01000000.00000018.sdmpString found in binary or memory: https://analytics.avcdn.net/v4/receive/json/25Sent
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2633304923.000000000354B000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2611110279.0000000003549000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2419712721.000000000354A000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000002.2976217934.0000000003544000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2514751340.0000000003549000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2454044676.000000000354A000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2632251172.000000000354A000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2574990179.0000000003549000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2547506208.000000000354A000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2406475523.0000000003549000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.avcdn.net/v4/receive/json/25l
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000002.2976217934.0000000003571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.avcdn.net/v4/receive/json/25s
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2405758044.000000000356C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.avcdn.net/v4/receive/json/25v
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000002.2976217934.0000000003517000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.avcdn.net:443/v4/receive/json/254
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000002.2976217934.0000000003517000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.avcdn.net:443/v4/receive/json/25t
                              Source: saBSI.exe, 0000000A.00000002.2897708570.0000000002E64000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2896422358.0000000002E63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://analytics.qa.apis.mcafee.com
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2628849428.0000000005C36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bloatware.ff.avast.com/avast/ss/
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000828000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://buddies.uno/Sof%
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000828000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://buddies.uno/Softwa
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000815000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://buddies.uno/Software/Eula/eula.htm
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760509842.000000000085F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.000000000087D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.000000000087D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1778301135.0000000000818000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000815000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://buddies.uno/Software/Eula/eula.html
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000828000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://buddies.uno/Software/PrivacyPolicy/Pri
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000828000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://buddies.uno/Software/PrivacyPolicy/Priv
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000828000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://buddies.uno/Software/PrivacyPolicy/Privao
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000828000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://buddies.uno/Software/PrivacyPolicy/PrivayP
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000828000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://buddies.uno/Software/PrivacyPolicy/PrivayPo
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1778301135.0000000000843000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000828000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://buddies.uno/Software/PrivacyPolicy/PrivayPol
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000828000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://buddies.uno/Software/PrivacyPolicy/PrivayPoli
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000828000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://buddies.uno/Software/PrivacyPolicy/PrivayPolicy
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000828000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1778301135.0000000000824000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://buddies.uno/Software/PrivacyPolicy/PrivayPolicy.&
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000828000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://buddies.uno/Software/PrivacyPolicy/PrivayPolicy.ht
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000828000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://buddies.uno/Software/PrivacyPolicy/PrivayPolicy.htm_ZHg
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760509842.000000000085F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.000000000087D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.000000000087D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1778301135.0000000000824000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.0000000000824000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.0000000000824000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://buddies.uno/Software/PrivacyPolicy/PrivayPolicy.html
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760710722.00000000007EF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://buddies.uno/Software/PrivacyPolicy/PrivayPolicy.htmlcampaign:opera_reengagedRE
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000828000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://buddies.uno/Softwarer
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2628849428.0000000005C36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn-download.avastbrowser.com/avg_secure_browser_setup.exe
                              Source: BitComet.exe, 0000000D.00000002.2420857876.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmp, BitComet.exe, 0000000D.00000000.2403166450.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmpString found in binary or memory: https://cdn.pawns.app/download/sdk/latest/windows/pawns-sdk.dll
                              Source: BitComet.exe, 0000000D.00000002.2420857876.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmp, BitComet.exe, 0000000D.00000000.2403166450.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmpString found in binary or memory: https://cdn.pawns.app/download/sdk/latest/windows/pawns-sdk.dllPawnsSDK
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2628849428.0000000005C36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore/detail/avg-online-security/nbmoafcmbajniiapeidgficgifbfmjfo?utm_s
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2450616405.0000000005E8C000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2604061607.0000000005C6A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://clients2.google.com/service/update2/crx
                              Source: BitComet.exe, 0000000D.00000002.2420857876.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmp, BitComet.exe, 0000000D.00000000.2403166450.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmpString found in binary or memory: https://clients2.google.com/service/update2/crxHKEY_LOCAL_MACHINE
                              Source: BitComet_2.08a_setup.exe, 00000005.00000002.2247774329.0000000000832000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://clients2.google.com/service/update2/crxSoftware
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2450616405.0000000005E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://clients2.google.com/service/update2/crxshow-windowargumentsas-32b-processsignedas-userworkin
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe, 00000000.00000003.2649478318.000000000227C000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe, 00000000.00000003.1695476894.0000000002570000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2627572791.0000000003622000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2631975906.0000000003734000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2622264821.0000000002390000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1703819395.0000000003490000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://control.kochava.com/v1/cpi/click?campaign_id=kohotspot-shield-2oo5a3058127822662&network_id=
                              Source: saBSI.exe, 0000000A.00000002.2897708570.0000000002E76000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2895072615.0000000002E73000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cu1pehnswad01.servicebus.windows.net/wadp32h02/messages?timeout=60&api-version=2014-01
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2450616405.0000000005E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://curl.se/docs/alt-svc.html
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2450616405.0000000005E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://curl.se/docs/hsts.html
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2450616405.0000000005E8C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://curl.se/docs/http-cookies.html
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe, 00000000.00000003.2649478318.000000000227C000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe, 00000000.00000003.1695476894.0000000002570000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2627572791.0000000003622000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2631975906.00000000036F9000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2622264821.0000000002390000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1703819395.0000000003490000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://d11iilsblp9z11.cloudfront.net/f/
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2635025040.0000000004EE5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.00000000007D7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2642171583.000000000756D000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2363617302.0000000004EE0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2411164366.0000000004EE4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d11iilsblp9z11.cloudfront.net/f/AVG_AV/files/1319/avg.zip
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2363617302.0000000004EE0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d11iilsblp9z11.cloudfront.net/f/AVG_AV/files/1319/avg.zipI.zi6
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2635025040.0000000004EE5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2411164366.0000000004EE4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d11iilsblp9z11.cloudfront.net/f/AVG_AV/files/1319/avg.zipI.ziI
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.000000000082E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d11iilsblp9z11.cloudfront.net/f/AVG_AV/files/1319/avg.zipI.zipvE30PraTCAoRM4emN7pEfhI;i
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2642171583.000000000756D000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://d11iilsblp9z11.cloudfront.net/f/AVG_AV/files/1319/avg.zipi
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2635025040.0000000004EE5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.00000000007D7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2363617302.0000000004EE0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2411164366.0000000004EE4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d11iilsblp9z11.cloudfront.net/f/AVG_AV/images/1509/EN.png
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.000000000085C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d11iilsblp9z11.cloudfront.net/f/AVG_AV/images/1509/EN.pngI.zip
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2363617302.0000000004EE0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d11iilsblp9z11.cloudfront.net/f/AVG_AV/images/1509/EN.pngng
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2635025040.0000000004EE5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2411164366.0000000004EE4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d11iilsblp9z11.cloudfront.net/f/AVG_AV/images/1509/EN.pngng36
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.000000000082E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d11iilsblp9z11.cloudfront.net/f/AVG_AV/images/1509/EN.pngngzA5vE30PraTCAoRM4emN7pEfhIdll
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe, 00000000.00000003.2649478318.000000000227C000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe, 00000000.00000003.1695476894.0000000002570000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2627572791.0000000003622000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2642171583.00000000074E9000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.0000000000842000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2622264821.0000000002390000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2642171583.0000000007591000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1703819395.0000000003490000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.0000000000835000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d11iilsblp9z11.cloudfront.net/f/BitComet/1548_Updated/BitComet_2.08a_setup.exe
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.000000000085C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2618744694.0000000000866000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.000000000085D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d11iilsblp9z11.cloudfront.net/f/BitComet/1548_Updated/BitComet_2.08a_setup.exeJ
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2622264821.0000000002418000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://d11iilsblp9z11.cloudfront.net/f/WebAdvisor/files/1489/saBSI.zip
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.000000000085C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2409204675.0000000004F36000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2362643784.0000000004F42000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2361027589.0000000004F3A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2636705232.0000000004F47000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d11iilsblp9z11.cloudfront.net/f/WebAdvisor/files/1489/saBSI.zipEC8
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.000000000085C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d11iilsblp9z11.cloudfront.net/f/WebAdvisor/files/1489/saBSI.zipEC84
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2409204675.0000000004F36000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2636705232.0000000004F47000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d11iilsblp9z11.cloudfront.net/f/WebAdvisor/files/1489/saBSI.zipEC8D
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.000000000085D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d11iilsblp9z11.cloudfront.net/f/WebAdvisor/files/1489/saBSI.zipEC8w
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2409204675.0000000004F36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d11iilsblp9z11.cloudfront.net/f/WebAdvisor/files/1489/saBSI.zipvE30PraTCAoRM4emN7pEfhIk
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2635025040.0000000004EE5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.00000000007D7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2363617302.0000000004EE0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2411164366.0000000004EE4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d11iilsblp9z11.cloudfront.net/f/WebAdvisor/images/NEW/EN.png
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2409204675.0000000004F36000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2636705232.0000000004F47000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d11iilsblp9z11.cloudfront.net/f/WebAdvisor/images/NEW/EN.png3f81fk
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe, 00000000.00000003.2649478318.000000000227C000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe, 00000000.00000003.1695476894.0000000002570000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2627572791.0000000003622000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2631975906.000000000374E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2622264821.0000000002390000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1703819395.0000000003490000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://d11iilsblp9z11.cloudfront.net/o
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe, 00000000.00000003.2649478318.000000000227C000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe, 00000000.00000003.1695476894.0000000002570000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2627572791.0000000003622000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2631975906.000000000374E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2409204675.0000000004F70000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2622264821.00000000024BA000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1778301135.000000000082F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1778301135.0000000000837000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2622264821.0000000002390000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1703819395.0000000003490000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://d11iilsblp9z11.cloudfront.net/zbd
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2633853589.0000000004EA5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d11iilsblp9z11.cloudfront.net:443/zbd9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2604061607.0000000005C6A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://firefoxextension.avast.com/aos/update.json
                              Source: msedgewebview2.exe, 00000021.00000003.2532289125.00003D28006AC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/w3c/csswg-drafts/issues/6939#issuecomment-1016679588
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2577221124.0000000005DA0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://hns-legacy.sb.avast.com
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.000000000085C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.0000000000842000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1778301135.000000000085C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://home.mcafee.com/Root/AboutUs.aspx?id=eula
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760509842.000000000085F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1778301135.0000000000861000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://home.mcafee.com/Root/AboutUs.aspx?iu
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2419762782.000000000358A000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2632392796.0000000003571000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2610630444.0000000003571000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2571577024.0000000003571000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2631626247.0000000003571000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2417641679.0000000003571000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2496843336.0000000003571000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000002.2976217934.0000000003571000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2574209553.0000000003571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2632392796.0000000003571000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2610630444.0000000003571000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2571577024.0000000003571000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2631626247.0000000003571000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000002.2976217934.0000000003571000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2574209553.0000000003571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/(
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2454248813.0000000003578000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2454404990.000000000358A000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2447801969.0000000003571000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2454099658.0000000003571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/-
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2547902689.0000000003571000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2536687235.0000000003571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/0
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2496843336.0000000003571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/Y
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2403613513.0000000003571000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2405758044.0000000003571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/defs/avg-av/release.xml.lzma
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2628849428.0000000005C36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/setup/avg-atrk/release/avg_antitrack_online_setup.exe
                              Source: avg_antivirus_free_setup.exe, 0000000B.00000002.2971743307.0000000004DFA000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2628849428.0000000005C36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/setup/avg-av/release/avg_antivirus_free_online_setup.exe
                              Source: avg_antivirus_free_setup.exe, 0000000B.00000002.2971743307.0000000004DFA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/setup/avg-av/release/avg_antivirus_free_online_setup.exeQ
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2628849428.0000000005C36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/setup/avg-bg/release/avg_breach_guard_online_setup.exe
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2628849428.0000000005C36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/setup/avg-bs/release/avg_battery_saver_online_setup.exe
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2628849428.0000000005C36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/setup/avg-du/release/avg_driver_updater_online_setup.exe
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2628849428.0000000005C36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/setup/avg-tu/release/avg_tuneup_online_setup.exe
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2628849428.0000000005C36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/setup/avg-vpn/release/avg_vpn_online_setup.exe
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2454099658.0000000003571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/universe/2445/f8a0/b75b/2445f8a0b75beb1a77428c2d605189876222fb9d53e3b187f7b
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2631626247.0000000003571000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000002.2976217934.0000000003517000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000002.2976217934.0000000003571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/universe/2603/2ae1/0582/26032ae10582074d1b38f8ad95372cfc56ce273d7a2766b2a0d
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2536687235.0000000003571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/universe/4d26/a67d/9fb8/4d26a67d9fb882ba9ddb9a8f90cfc0a1f17c5f526abb83671f6
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2536687235.0000000003571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/universe/9cad/b56d/c6bd/9cadb56dc6bdef59526a6aca8423fbda0000124bf15228cd536
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000002.2976217934.0000000003571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/universe/9fcc/f245/57f7/9fccf24557f7691f06726fa651a35b48bdbac4556cb63188ca7
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2574209553.0000000003571000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/universe/d936/7c5e/474b/d9367c5e474bca83cb06f583f2fb42ef2517d769cc82722201a
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000002.2976217934.0000000003517000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net/universe/dbef/c0c1/a778/dbefc0c1a7785fe08ae05046f72095acf3f3bfc348d370c99e4
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000002.2976217934.0000000003517000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net:443/universe/2603/2ae1/0582/26032ae10582074d1b38f8ad95372cfc56ce273d7a2766b
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000002.2976217934.0000000003517000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net:443/universe/9cad/b56d/c6bd/9cadb56dc6bdef59526a6aca8423fbda0000124bf15228c
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000002.2976217934.0000000003517000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://honzik.avcdn.net:443/universe/9fcc/f245/57f7/9fccf24557f7691f06726fa651a35b48bdbac4556cb6318
                              Source: msedgewebview2.exe, 00000021.00000003.2532289125.00003D28006AC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/C/#the-details-and-summary-elements
                              Source: msedgewebview2.exe, 00000021.00000003.2532289125.00003D28006AC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/rendering.html#flow-content-3
                              Source: msedgewebview2.exe, 00000021.00000003.2532289125.00003D28006AC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/rendering.html#hidden-elements
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2628849428.0000000005C36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://id.avast.com/inAvastium
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2628849428.0000000005C36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://id.avg.com
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2628849428.0000000005C36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://identityprotection.avg.com
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2628849428.0000000005C36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipm-provider.ff.avast.com/
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2628849428.0000000005C36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipm.avcdn.net/
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe, 00000000.00000000.1694684999.0000000000401000.00000020.00000001.01000000.00000003.sdmpString found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
                              Source: BitComet_stats.exe, 00000008.00000002.2230476280.000000000070C000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000003.2228162848.000000000070C000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000003.2227044278.000000000070C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.comsoft
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2628849428.0000000005C36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://my.avast.com
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2628849428.0000000005C36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pair.ff.avast.com
                              Source: BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://picsum.photos/364/202?image=883
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2628849428.0000000005C36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://prod1-fe-basic-auth-breach.prod.aws.lifelock.com
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760509842.000000000085F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.000000000082E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://reasonlabs.com/policies
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2628849428.0000000005C36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://s-nuistatic.avcdn.net/nui/avg/1.0.749/updatefile.json
                              Source: saBSI.exe, 0000000A.00000002.2897708570.0000000002E4E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.m
                              Source: saBSI.exe, 0000000A.00000003.2401223602.0000000002F04000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.co
                              Source: saBSI.exe, 0000000A.00000003.2444175220.0000000002F2A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002EB9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/
                              Source: saBSI.exe, 0000000A.00000003.2444175220.0000000002F2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/G
                              Source: saBSI.exe, 0000000A.00000003.2444175220.0000000002F2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/U
                              Source: saBSI.exe, saBSI.exe, 0000000A.00000003.2719167639.0000000002EE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/
                              Source: saBSI.exe, 0000000A.00000003.2730262487.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2401223602.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720973329.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2884883686.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720589934.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2730852804.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2721125963.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002F1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/Win/binary/3.7.2/update_bsi_product.xml
                              Source: saBSI.exe, 0000000A.00000003.2730262487.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2401223602.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720973329.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2884883686.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720589934.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2730852804.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2721125963.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002F1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/Win/binary/3.7.2/update_bsi_product.xml/
                              Source: saBSI.exe, 0000000A.00000003.2730262487.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2401223602.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720973329.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2884883686.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720589934.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2730852804.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2721125963.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002F1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/Win/binary/4.1.0/update_bsi_self.xml
                              Source: saBSI.exe, 0000000A.00000003.2730262487.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2401223602.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720973329.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2884883686.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720589934.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2730852804.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2721125963.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002F1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/Win/binary/4.1.0/update_bsi_self.xml/
                              Source: saBSI.exe, 0000000A.00000002.2897708570.0000000002EE3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000002.2897708570.0000000002E4E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2896027780.0000000002EE3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002EE3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002EE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_DistributionRules.xml
                              Source: saBSI.exe, 0000000A.00000003.2401095516.0000000005404000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_DistributionRules.xml/
                              Source: saBSI.exe, 0000000A.00000003.2401223602.0000000002F04000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000002.2897708570.0000000002EE3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2896027780.0000000002EE3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002EE3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002EE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_DistributionRulesISB.xml
                              Source: saBSI.exe, 0000000A.00000003.2401095516.0000000005404000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_DistributionRulesISB.xml/
                              Source: saBSI.exe, 0000000A.00000003.2401223602.0000000002F1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_Pa
                              Source: saBSI.exe, 0000000A.00000003.2730262487.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2401223602.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720973329.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2895072615.0000000002E8D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2884883686.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720589934.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2730852804.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2721125963.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000002.2897708570.0000000002E8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_PaidDistribution.xml
                              Source: saBSI.exe, 0000000A.00000003.2730262487.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2401223602.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720973329.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2884883686.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720589934.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2730852804.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2721125963.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002F1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_PaidDistribution.xml/
                              Source: saBSI.exe, 0000000A.00000003.2728067926.0000000002EE3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002EE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_PaidDistribution.xmltT
                              Source: saBSI.exe, 0000000A.00000003.2730262487.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2401223602.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720973329.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2884883686.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720589934.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2730852804.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2721125963.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002F1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_PartnerDistribution.xml
                              Source: saBSI.exe, 0000000A.00000003.2730262487.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2401223602.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720973329.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2884883686.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720589934.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2730852804.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2721125963.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002F1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_PartnerDistribution.xml/
                              Source: saBSI.exe, 0000000A.00000003.2719167639.0000000002F1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_abtest.
                              Source: saBSI.exe, 0000000A.00000003.2444175220.0000000002F2A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2884328927.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2718431117.0000000005404000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_abtest.xml
                              Source: saBSI.exe, 0000000A.00000003.2730262487.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2401223602.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2883408378.0000000005421000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2729383650.0000000005421000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720973329.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2884257310.0000000005421000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2884883686.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2731341920.0000000005421000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2718431117.0000000005421000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720589934.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2730852804.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2721125963.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2486584163.0000000005421000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720457018.0000000005421000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_abtest.xml/
                              Source: saBSI.exe, saBSI.exe, 0000000A.00000003.2719167639.0000000002EBA000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000000.2344892193.00000000006DE000.00000002.00000001.01000000.00000016.sdmp, saBSI.exe, 0000000A.00000003.2373312406.0000000002EBA000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002EB9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_main.xml
                              Source: saBSI.exe, 0000000A.00000003.2401223602.0000000002F04000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000002.2897708570.0000000002EE3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2896027780.0000000002EE3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002EE3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002EE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_vars.x
                              Source: saBSI.exe, 0000000A.00000003.2730262487.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2401223602.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720973329.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2884883686.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720589934.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2730852804.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2721125963.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002F1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_vars.xml
                              Source: saBSI.exe, 0000000A.00000003.2730262487.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2401223602.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720973329.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2884883686.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720589934.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2730852804.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2721125963.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002F1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_vars.xml/
                              Source: saBSI.exe, 0000000A.00000000.2344892193.00000000006DE000.00000002.00000001.01000000.00000016.sdmp, saBSI.exe, 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/UPDATER_VERSIONaffidosplatSELF_UPDATE_ALLOWEDMAIN_XMLSTORE
                              Source: saBSI.exe, saBSI.exe, 0000000A.00000002.2897708570.0000000002E64000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2896422358.0000000002E63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/Win/xpi/webadvisor/update.json
                              Source: saBSI.exe, 0000000A.00000002.2897708570.0000000002E64000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2896422358.0000000002E63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/Win/xpi/webadvisor/update.json&
                              Source: saBSI.exe, 0000000A.00000002.2897708570.0000000002E64000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2896422358.0000000002E63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/Win/xpi/webadvisor/update.json&X0
                              Source: saBSI.exe, 0000000A.00000003.2896422358.0000000002E63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/Win/xpi/webadvisor/update.jsonRS=2On
                              Source: saBSI.exe, 0000000A.00000003.2884586261.0000000005405000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2894779605.0000000005408000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2731341920.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2729383650.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2486584163.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2884328927.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2718431117.0000000005404000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/bsi
                              Source: saBSI.exe, 0000000A.00000003.2883408378.0000000005421000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2729383650.0000000005421000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2884257310.0000000005421000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2731341920.0000000005421000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2718431117.0000000005421000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2486584163.0000000005421000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720457018.0000000005421000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/bsi/
                              Source: saBSI.exe, 0000000A.00000003.2730262487.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2401223602.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720973329.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2884883686.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720589934.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2730852804.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2721125963.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002F1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/bsi/4.1.1/install.xml
                              Source: saBSI.exe, 0000000A.00000003.2730262487.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2401223602.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720973329.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2884883686.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720589934.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2730852804.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2721125963.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002F1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/bsi/4.1.1/install.xml/
                              Source: saBSI.exe, 0000000A.00000002.2897708570.0000000002EB9000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2895072615.0000000002EB9000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002EBA000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002EB9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/bsi/4.1.1/install.xmlhe
                              Source: saBSI.exe, 0000000A.00000002.2897708570.0000000002EB9000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2895072615.0000000002EB9000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002EBA000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002EB9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/bsi/binaryFoxPathm
                              Source: saBSI.exe, 0000000A.00000003.2730262487.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720973329.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2884883686.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002EBA000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720589934.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2730852804.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2721125963.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002EB9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/installer/4.1.1/914/
                              Source: saBSI.exe, 0000000A.00000003.2728067926.0000000002EE3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002EE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/installer/4.1.1/914/64/installer.exe
                              Source: saBSI.exe, 0000000A.00000003.2728067926.0000000002EE3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002EE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/installer/4.1.1/914/64/installer.exeexeI
                              Source: saBSI.exe, 0000000A.00000003.2719167639.0000000002EBA000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002EB9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/installer/4.1.1/914/64/installer.exem
                              Source: saBSI.exe, 0000000A.00000003.2719167639.0000000002EBA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/installer/4.1.1/914/64/installer.exemd
                              Source: saBSI.exe, 0000000A.00000003.2730262487.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720973329.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2884883686.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002EBA000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720589934.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2730852804.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2721125963.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002F1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/pc/partner_custom_bsi.xml
                              Source: saBSI.exe, 0000000A.00000003.2730262487.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000002.2897708570.0000000002F2A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2884586261.0000000005405000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000002.2897708570.0000000002EB9000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720973329.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2894505897.0000000002F2A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2895072615.0000000002EB9000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000002.2900191307.0000000005405000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2884883686.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000002.2900118315.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720589934.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2730852804.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2721125963.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2884328927.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2884729376.00000000053F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/update/post_install.xml
                              Source: saBSI.exe, 0000000A.00000002.2897708570.0000000002EE3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2896027780.0000000002EE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/update/post_install.xmlml
                              Source: saBSI.exe, 0000000A.00000002.2897708570.0000000002EE3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2896027780.0000000002EE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/update/post_install.xmlw
                              Source: saBSI.exe, 0000000A.00000002.2897708570.0000000002E64000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2896422358.0000000002E63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/sa
                              Source: saBSI.exe, 0000000A.00000003.2884586261.0000000005405000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2894779605.0000000005408000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2731341920.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2729383650.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2486584163.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2884328927.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2718431117.0000000005404000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/sa/bsi/win/binary
                              Source: saBSI.exe, 0000000A.00000003.2883408378.0000000005421000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2729383650.0000000005421000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2884257310.0000000005421000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2731341920.0000000005421000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2718431117.0000000005421000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2486584163.0000000005421000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720457018.0000000005421000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/sa/bsi/win/binary/
                              Source: saBSI.exe, 0000000A.00000003.2489648876.000000000544A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2486098296.000000000545D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002EBA000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2486584163.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002EE3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002EB9000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2718431117.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002EE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/sa/v1/pc/partner_custom_vars.xml
                              Source: saBSI.exe, 0000000A.00000003.2896422358.0000000002E63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/saLOCALA
                              Source: saBSI.exe, 0000000A.00000000.2344892193.00000000006DE000.00000002.00000001.01000000.00000016.sdmp, saBSI.exe, 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://sadownload.mcafee.com/products/saUPDATER_URLupdater.exeWebAdvisor_Updaterheron_hostthreat.ap
                              Source: saBSI.exe, 0000000A.00000003.2444175220.0000000002F2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/r
                              Source: saBSI.exe, 0000000A.00000003.2720973329.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720589934.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2721125963.0000000002F1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com/t
                              Source: saBSI.exe, 0000000A.00000003.2719167639.0000000002F1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com:443/products/SA/BSI/bsi_DistributionRules.xmlRECONDITION
                              Source: saBSI.exe, 0000000A.00000003.2719167639.0000000002EE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sadownload.mcafee.com:443/products/SA/v1/installer/4.1.1/914/64/installer.exe
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2604061607.0000000005C6A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://shepherd.avcdn.net
                              Source: avg_antivirus_free_setup.exe, 0000000B.00000003.2388808034.0000000004E58000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2633304923.000000000354B000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000002.2995522970.0000000005490000.00000002.00000001.00040000.00000018.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000002.2976217934.0000000003517000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://shepherd.avcdn.net/
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1778301135.0000000000843000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.000000000083F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000828000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.0000000000842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://shield.reasonsecurity.com/rsStubActivator.exe
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2628849428.0000000005C36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://stream-production.avcdn.net
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2577221124.0000000005DA0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://submit.sb.avast.com
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2577221124.0000000005DA0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://viruslab-samples.sb.avast.com
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000828000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760509842.000000000085F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.000000000082E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://webcompanion.com/privacy
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000828000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760509842.000000000085F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.000000000082E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://webcompanion.com/terms
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2577221124.0000000005DA0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://winqual.sb.avast.com
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2577221124.0000000005DA0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://winqual.sb.avast.comhttps://hns-legacy.sb.avast.comhttps://submit.sb.avast.comhttps://virusl
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2627572791.0000000003622000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760509842.000000000085F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.000000000087D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.000000000087D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/en/license/
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.0000000000818000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.0000000000818000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1778301135.0000000000818000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000815000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2618744694.000000000081A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/en/license/u=
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.0000000000818000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2627572791.0000000003622000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.0000000000818000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.000000000087D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.000000000087D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1778301135.0000000000818000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000815000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.360totalsecurity.com/en/privacy/
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2627572791.0000000003622000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.000000000083F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.0000000000854000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000828000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760509842.000000000085F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1778301135.0000000000854000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avast.com/eula#pc
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.000000000085C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avast.com/eula-avast-c
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000828000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760509842.000000000085F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.0000000000842000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1778301135.000000000085C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avast.com/eula-avast-consumer-products
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.000000000085C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avast.com/eula-avast-cv
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.000000000082E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1778301135.000000000085C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avast.com/privacy-policy
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2627572791.0000000003622000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760509842.000000000085F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avast.com/privacy-policy#pc
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.0000000000818000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.0000000000818000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1778301135.0000000000818000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000815000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2618744694.000000000081A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avast.com/privacy-policy#pcl
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2642171583.0000000007566000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.avg.com/ww-en/
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2633853589.0000000004EB6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2642171583.00000000074E2000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.avg.com/ww-en/eula
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2360300158.0000000004F5D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2361467884.0000000004F54000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2363199165.0000000004F68000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2409204675.0000000004F6A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avg.com/ww-en/eula/en-us/
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2637685057.0000000004F5F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2409204675.0000000004F5E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2409753961.0000000004F5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avg.com/ww-en/eula/en-us/g
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.000000000085C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avg.com/ww-en/eula/en-us/policy/legal.html09/EN.pngI.zip.08a_s
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.000000000082E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avg.com/ww-en/eulaL
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2642171583.000000000759F000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.avg.com/ww-en/priv
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2642171583.000000000757B000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2363333750.0000000004F7B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2636705232.0000000004F47000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2622264821.0000000002408000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2633853589.0000000004EB6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2642171583.00000000074E2000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.avg.com/ww-en/privacy
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2360300158.0000000004F5D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2361467884.0000000004F54000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2363199165.0000000004F68000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2409204675.0000000004F6A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avg.com/ww-en/privacy-us/
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2637685057.0000000004F5F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2409204675.0000000004F5E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2409753961.0000000004F5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avg.com/ww-en/privacy-us/K
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.000000000085C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avg.com/ww-en/privacy-us/policy/legal.htmls/NEW/EN.pngipe
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2409204675.0000000004F5E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2409753961.0000000004F5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avg.com/ww-en/privacynet/
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.000000000085C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avg.com/ww-en/privacynet/f/WebAdvisor/images/NEW/EN.pngipS
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2637685057.0000000004F5F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2409204675.0000000004F5E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2409753961.0000000004F5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avg.com/ww-en/privacynet/j
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.000000000082E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.avg.com/ww-en/privacynet/r
                              Source: BitComet.exe, 0000000D.00000002.2420857876.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmp, BitComet.exe, 0000000D.00000000.2403166450.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmpString found in binary or memory: https://www.bitcomet.com
                              Source: BitComet_stats.exe, 00000008.00000003.2227384369.00000000006D4000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000002.2230080233.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000003.2228368885.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000002.2230315967.00000000006D4000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000003.2228249240.00000000006D4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.bitcomet.com/
                              Source: BitComet_stats.exe, 00000008.00000002.2230476280.000000000070C000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000003.2228162848.000000000070C000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000003.2227044278.000000000070C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.bitcomet.com/:
                              Source: BitComet_stats.exe, 00000008.00000002.2230476280.000000000070C000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000003.2228162848.000000000070C000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000003.2227044278.000000000070C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.bitcomet.com/J
                              Source: BitComet_2.08a_setup.exe, 00000005.00000002.2247774329.0000000000832000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.bitcomet.com/client/help/?item=install_firefox_extension&v=2.08&l=
                              Source: BitComet_2.08a_setup.exe, 00000005.00000002.2247774329.0000000000832000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.bitcomet.com/client/install-stats/?l=
                              Source: BitComet_2.08a_setup.exeString found in binary or memory: https://www.bitcomet.com/client/install-stats/?l=en_us&file=Bit
                              Source: BitComet_2.08a_setup.exeString found in binary or memory: https://www.bitcomet.com/client/install-stats/?l=en_us&file=BitC
                              Source: BitComet_stats.exe, 00000008.00000002.2230297660.00000000006CF000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000002.2229464470.0000000000670000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.bitcomet.com/client/install-stats/?l=en_us&file=BitComet_2.08a_setup.exe&p=x64
                              Source: BitComet_stats.exe, 00000008.00000002.2230476280.000000000070C000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000003.2228162848.000000000070C000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000003.2227044278.000000000070C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.bitcomet.com/client/install-stats/?l=en_us&file=BitComet_2.08a_setup.exe&p=x64(
                              Source: BitComet_stats.exe, 00000008.00000003.2228323587.00000000006CF000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000003.2228442765.00000000006CF000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000002.2230297660.00000000006CF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.bitcomet.com/client/install-stats/?l=en_us&file=BitComet_2.08a_setup.exe&p=x64.
                              Source: BitComet_stats.exe, 00000008.00000003.2228323587.00000000006CF000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000003.2228442765.00000000006CF000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000002.2230297660.00000000006CF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.bitcomet.com/client/install-stats/?l=en_us&file=BitComet_2.08a_setup.exe&p=x64:
                              Source: BitComet_stats.exe, 00000008.00000003.2228323587.00000000006C3000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000002.2230194299.00000000006C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.bitcomet.com/client/install-stats/?l=en_us&file=BitComet_2.08a_setup.exe&p=x64;
                              Source: BitComet_stats.exe, 00000008.00000003.2228323587.00000000006C3000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000002.2230194299.00000000006C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.bitcomet.com/client/install-stats/?l=en_us&file=BitComet_2.08a_setup.exe&p=x64=
                              Source: BitComet_2.08a_setup.exe, 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmp, BitComet_stats.exe, 00000008.00000002.2229356875.00000000004E0000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000002.2229464470.0000000000670000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.bitcomet.com/client/install-stats/?l=en_us&file=BitComet_2.08a_setup.exe&p=x64C:
                              Source: BitComet_2.08a_setup.exe, 00000005.00000002.2247240321.0000000000610000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.bitcomet.com/client/install-stats/?l=en_us&file=BitComet_2.08a_setup.exe&p=x64DAC:
                              Source: BitComet_stats.exe, 00000008.00000002.2228633981.0000000000190000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: https://www.bitcomet.com/client/install-stats/?l=en_us&file=BitComet_2.08a_setup.exe&p=x64R
                              Source: BitComet_stats.exe, 00000008.00000003.2228323587.00000000006CF000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000003.2228442765.00000000006CF000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000002.2230297660.00000000006CF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.bitcomet.com/client/install-stats/?l=en_us&file=BitComet_2.08a_setup.exe&p=x64i
                              Source: BitComet_stats.exe, 00000008.00000002.2230476280.000000000070C000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000003.2228162848.000000000070C000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000003.2227044278.000000000070C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.bitcomet.com/client/install-stats/?l=en_us&file=BitComet_2.08a_setup.exe&p=x64r
                              Source: BitComet_stats.exe, 00000008.00000002.2229464470.0000000000670000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.bitcomet.com/client/install-stats/?l=en_us&file=BitComet_2.08a_setup.exe&p=x64w
                              Source: BitComet_stats.exe, 00000008.00000003.2228323587.00000000006C3000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000002.2230194299.00000000006C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.bitcomet.com/client/install-stats/?l=en_us&file=BitComet_2.08a_setup.exe&p=x64z
                              Source: BitComet_2.08a_setup.exe, 00000005.00000002.2247774329.0000000000832000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.bitcomet.com/client/install-without-google-cannot/?install=silence&l=
                              Source: BitComet.exe, 0000000D.00000002.2420857876.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmp, BitComet.exe, 0000000D.00000000.2403166450.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmpString found in binary or memory: https://www.bitcomet.com/client/video-download/AddFlashAddPictureLinkAddPictureOpenBCTPListOpenBCTPD
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.000000000085C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2642171583.00000000074E9000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2622264821.0000000002390000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1703819395.0000000003490000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.bitcomet.com/doc/privacy-policy.php
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.000000000082E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.000000000082E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.bitcomet.com/doc/privacy-policy.phpitComet
                              Source: BitComet.exe, 0000000D.00000003.2413977005.0000023E813D8000.00000004.00000020.00020000.00000000.sdmp, BitComet.exe, 0000000D.00000003.2413761678.0000023E813C7000.00000004.00000020.00020000.00000000.sdmp, BitComet.exe, 0000000D.00000002.2418320040.0000023E813D9000.00000004.00000020.00020000.00000000.sdmp, BitComet.exe, 0000000D.00000003.2413848761.0000023E813D3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.bitcomet.com/en/privacy-policy
                              Source: BitComet.exe, 0000000D.00000003.2413977005.0000023E813D8000.00000004.00000020.00020000.00000000.sdmp, BitComet.exe, 0000000D.00000003.2413761678.0000023E813C7000.00000004.00000020.00020000.00000000.sdmp, BitComet.exe, 0000000D.00000002.2418320040.0000023E813D9000.00000004.00000020.00020000.00000000.sdmp, BitComet.exe, 0000000D.00000003.2413848761.0000023E813D3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.bitcomet.com/en/privacy-policyI
                              Source: BitComet_stats.exe, 00000008.00000003.2227384369.00000000006D4000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000002.2230315967.00000000006D4000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000003.2228249240.00000000006D4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.bitcomet.com/t
                              Source: BitComet.exe, 0000000D.00000002.2420857876.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmp, BitComet.exe, 0000000D.00000000.2403166450.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmpString found in binary or memory: https://www.bitcomet.comupdate
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110344218.0000000004EDD000.00000004.00000020.00020000.00000000.sdmp, BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmp, BitComet_2.08a_setup.exe, 00000005.00000003.2216838446.00000000030F3000.00000004.00000020.00020000.00000000.sdmp, BitComet.exe, 0000000D.00000003.2405439939.0000023E833A5000.00000004.00001000.00020000.00000000.sdmp, BitComet.exe, 0000000E.00000003.2413441796.0000021F09335000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.certum.pl/CPS0
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2344093536.0000000004F1E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2359323053.0000000006345000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2874180498.00000000057B6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2731341920.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2884883686.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2731341920.0000000005421000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2729383650.000000000544A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720457018.000000000540E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2729383650.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2731341920.000000000544A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000002.2901328913.00000000057B6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002EE3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2717611623.00000000054EE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2733919705.00000000056F3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2718431117.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002EE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.globalsign.com/repository/0
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe, 00000000.00000003.1700603344.000000007FB50000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe, 00000000.00000003.1698345675.00000000026B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000000.1702051510.0000000000401000.00000020.00000001.01000000.00000004.sdmpString found in binary or memory: https://www.innosetup.com/
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.000000000085C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1778301135.000000000085C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mcafee.com/consumer/en-us/policy/global/lega
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000828000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mcafee.com/consumer/en-us/policy/global/legal
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2627572791.0000000003622000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000828000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.00000000007D7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mcafee.com/consumer/en-us/policy/global/legal.html
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110344218.0000000004EF6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mcafee.com/consumer/en-us/policy/legal.html
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000828000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1778301135.0000000000824000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.0000000000824000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.0000000000824000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mcafee.com/consumer/en-us/policy/legal.html$Z
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000828000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1778301135.0000000000824000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.0000000000824000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.0000000000824000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mcafee.com/consumer/en-us/policy/legal.html5Z
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110764000.0000000000809000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mcafee.com/consumer/en-us/policy/legal.htmld
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.0000000000809000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mcafee.com/consumer/en-us/policy/legal.htmlr
                              Source: saBSI.exe, 0000000A.00000002.2897708570.0000000002E64000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000000.2344892193.00000000006DE000.00000002.00000001.01000000.00000016.sdmp, saBSI.exe, 0000000A.00000002.2897708570.0000000002E4E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmp, saBSI.exe, 0000000A.00000003.2896422358.0000000002E63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mcafee.com/consumer/v/wa-how.html
                              Source: saBSI.exe, 0000000A.00000002.2897708570.0000000002E64000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2896422358.0000000002E63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mcafee.com/consumer/v/wa-how.html6
                              Source: saBSI.exe, 0000000A.00000002.2897708570.0000000002E64000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2896422358.0000000002E63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mcafee.com/consumer/v/wa-how.htmlD
                              Source: saBSI.exe, 0000000A.00000002.2897708570.0000000002E64000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2896422358.0000000002E63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mcafee.com/consumer/v/wa-how.htmlY
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760509842.000000000085F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2617899539.00000000007BF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.nortonlifelock.com/us/en/legal/license-services-agreement/
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760509842.000000000085F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.nortonlifelock.com/us/en/privacy/
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.0000000000818000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.0000000000818000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1778301135.0000000000818000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000815000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2618744694.000000000081A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.nortonlifelock.com/us/en/privacy/F=
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760509842.000000000085F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.000000000087D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.000000000087D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1778301135.0000000000818000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000815000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2618744694.000000000081A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.opera.com/he/eula/computers
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760509842.000000000085F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.000000000087D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.000000000087D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.000000000082E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.opera.com/he/privacy
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2627572791.0000000003622000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000828000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760509842.000000000085F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1778301135.0000000000824000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.0000000000824000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.0000000000824000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.premieropinion.com/common/termsofservice-v1
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.0000000000818000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2627572791.0000000003622000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.0000000000818000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760509842.000000000085F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1778301135.0000000000818000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000815000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2618744694.000000000081A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.premieropinion.com/privacy-policy
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe, 00000000.00000003.1700603344.000000007FB50000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe, 00000000.00000003.1698345675.00000000026B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000000.1702051510.0000000000401000.00000020.00000001.01000000.00000004.sdmpString found in binary or memory: https://www.remobjects.com/ps
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.0000000000818000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.0000000000818000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760509842.000000000085F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1778301135.0000000000818000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000815000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2618744694.000000000081A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.winzip.com/win/en/eula.html
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.0000000000818000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.0000000000818000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760509842.000000000085F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1778301135.0000000000818000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000815000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2618744694.000000000081A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.winzip.com/win/en/privacy.html
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49800 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49781 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49820 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49812 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49784 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49823 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49806 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49777 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49886 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49869 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49834 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49828 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49805 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49831 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49836
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49834
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49833
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49799
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49832
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49831
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49797
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49830
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49796
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49870 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49796 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49825 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49811 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49828
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49884 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49827
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49825
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49824
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49867 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49823
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49820
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49784
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49781
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49836 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49807 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49833 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49776 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49799 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49810 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49816
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49815
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49779
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49812
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49885 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49811
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49777
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49810
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49816 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49776
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49879 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49827 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49802 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49830 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49807
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49806
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49805
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49804
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49802
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49801
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49800
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49886
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49885
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49884
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49815 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49797 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49801 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49824 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49879
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49870
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49804 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49832 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49869
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49867
                              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
                              Source: unknownHTTPS traffic detected: 13.249.12.125:443 -> 192.168.2.4:49734 version: TLS 1.2
                              Source: unknownHTTPS traffic detected: 13.249.12.125:443 -> 192.168.2.4:49735 version: TLS 1.2
                              Source: unknownHTTPS traffic detected: 13.249.12.125:443 -> 192.168.2.4:49737 version: TLS 1.2
                              Source: unknownHTTPS traffic detected: 13.249.12.125:443 -> 192.168.2.4:49739 version: TLS 1.2
                              Source: unknownHTTPS traffic detected: 13.249.12.125:443 -> 192.168.2.4:49745 version: TLS 1.2
                              Source: unknownHTTPS traffic detected: 13.249.12.125:443 -> 192.168.2.4:49746 version: TLS 1.2
                              Source: unknownHTTPS traffic detected: 13.249.12.125:443 -> 192.168.2.4:49748 version: TLS 1.2
                              Source: unknownHTTPS traffic detected: 143.204.205.88:443 -> 192.168.2.4:49750 version: TLS 1.2
                              Source: unknownHTTPS traffic detected: 52.25.171.187:443 -> 192.168.2.4:49751 version: TLS 1.2
                              Source: unknownHTTPS traffic detected: 143.204.205.88:443 -> 192.168.2.4:49753 version: TLS 1.2
                              Source: unknownHTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49760 version: TLS 1.2
                              Source: unknownHTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49762 version: TLS 1.2
                              Source: unknownHTTPS traffic detected: 52.25.171.187:443 -> 192.168.2.4:49777 version: TLS 1.2
                              Source: unknownHTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49832 version: TLS 1.2
                              Source: unknownHTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49833 version: TLS 1.2
                              Source: unknownHTTPS traffic detected: 34.160.176.28:443 -> 192.168.2.4:49834 version: TLS 1.2
                              Source: unknownHTTPS traffic detected: 34.160.176.28:443 -> 192.168.2.4:49836 version: TLS 1.2
                              Source: unknownHTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49867 version: TLS 1.2
                              Source: unknownHTTPS traffic detected: 34.117.223.223:443 -> 192.168.2.4:49869 version: TLS 1.2
                              Source: unknownHTTPS traffic detected: 34.160.176.28:443 -> 192.168.2.4:49870 version: TLS 1.2
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeCode function: 5_2_0040558F GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,5_2_0040558F
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeFile created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C5C8CC0A7FE31816B4641D0465402560Jump to dropped file

                              Spam, unwanted Advertisements and Ransom Demands

                              barindex
                              Writes a notice file (html or txt) to demand a ransom
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile dropped: C:\Program Files\McAfee\Temp1561643107\jslang\eula-en-US.txt -> encryption key for your account secure because without them you may lose access to your data. you are solely responsible and liable for any activity that occurs under your account, including by anyone who uses your account. if there is any unauthorized use or access to your account, you must let us know immediately. we are not responsible for any loss caused by unauthorized use of or access to your account; however, you may be liable for any losses we or others suffer because of the unauthorized use. we do not have access to master passwords and cannot recover your encrypted data if you forget the master password for any password management feature or product. we offer both free and premium versions of our password and identity management software, and the free versions limit the maximum number of unique accounts (such as a website or application login) that you can store. if you have downloaded a premium version of the software at no cost during a promotion, then when the promotional period ends you will notJump to dropped file
                              Writes many files with high entropy
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpFile created: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe (copy) entropy: 7.99986272716Jump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpFile created: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0 (copy) entropy: 7.99597518735Jump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpFile created: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1 (copy) entropy: 7.99668482326Jump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpFile created: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0.zip (copy) entropy: 7.99597518735Jump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpFile created: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1.zip (copy) entropy: 7.99668482326Jump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeFile created: C:\Users\user\AppData\Roaming\BitComet\fav\embed_bcfs.zip entropy: 7.99358347494Jump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeFile created: C:\Users\user\AppData\Roaming\BitComet\fav\embed_bcfs_full.zip entropy: 7.99269261447Jump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeFile created: C:\Users\user\AppData\Roaming\BitComet\fav\embed_bcsp.zip entropy: 7.99375900364Jump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeFile created: C:\Users\user\AppData\Roaming\BitComet\fav\embed_bcxt.zip entropy: 7.99507714827Jump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeFile created: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe entropy: 7.99275939838Jump to dropped file
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\1802c68f-2f28-4075-9083-9e338a0c19c8 entropy: 7.99995619726Jump to dropped file
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\b160c05d-00aa-411d-8673-8b4473a458a7 entropy: 7.9998155782Jump to dropped file
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\c42c22c9-fabf-4e67-8f42-1d89e7da9849 entropy: 7.99988827099Jump to dropped file
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\e1423531-f6b5-40bf-a17c-6bfd64d490eb entropy: 7.99872246404Jump to dropped file
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\setupui.cont entropy: 7.99951433164Jump to dropped file
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\645cb7cb-fd81-4ba0-9161-5880e64c7118 entropy: 7.99948650564Jump to dropped file
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\c21d9a86-afda-4a33-9ad7-d657cb6d993a entropy: 7.99992383249Jump to dropped file
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeFile created: C:\Users\user\AppData\Local\BitComet\EBWebView\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371 entropy: 7.99964947406Jump to dropped file
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeFile created: C:\Users\user\AppData\Local\BitComet\EBWebView\SmartScreen\RemoteData\topTraffic_638004170464094982 entropy: 7.99962590804Jump to dropped file
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeFile created: C:\Users\user\AppData\Local\BitComet\EBWebView\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2 entropy: 7.99333285467Jump to dropped file
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeFile created: C:\Users\user\AppData\Local\BitComet\EBWebView\SmartScreen\RemoteData\customSynchronousLookupUris_0 entropy: 7.99333285467Jump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av-vps\icarus.exe.lzma entropy: 7.99992146095Jump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av-vps\icarus_product.dll.lzma entropy: 7.99939738909Jump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av-vps\icarus_rvrt.exe.lzma entropy: 7.99297729358Jump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av-vps\dump_process.exe.lzma entropy: 7.99979850494Jump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\icarus_product.dll.lzma entropy: 7.99990382609Jump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av-vps\bug_report.exe.lzma entropy: 7.99985706293Jump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\icarus_rvrt.exe.lzma entropy: 7.99297729358Jump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\aswOfferTool.exe.lzma entropy: 7.99980527255Jump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\setupui.cont entropy: 7.99951433164Jump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\mfw-webadvisor.cab entropy: 7.99753562082Jump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\mfw.cab entropy: 7.99533782215Jump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\servicehost.cab entropy: 7.99713063183Jump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\settingmanager.cab entropy: 7.99941777147Jump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\taskmanager.cab entropy: 7.99942858602Jump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\uihost.cab entropy: 7.99694976819Jump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\uimanager.cab entropy: 7.99951531158Jump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\uninstaller.cab entropy: 7.99951416644Jump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\updater.cab entropy: 7.99941364204Jump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\wataskmanager.cab entropy: 7.99988208039Jump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\wssdep.cab entropy: 7.99882239583Jump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\analyticsmanager.cab entropy: 7.99953278408Jump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\browserhost.cab entropy: 7.99940380547Jump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\browserplugin.cab entropy: 7.99921391906Jump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\downloadscan.cab entropy: 7.99975601196Jump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\eventmanager.cab entropy: 7.99960352381Jump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\logicmodule.cab entropy: 7.99960620162Jump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\lookupmanager.cab entropy: 7.99935848954Jump to dropped file

                              System Summary

                              barindex
                              Found suspicious ZIP file
                              Source: FirefoxExtension.xpi.5.drZip Entry: background.js
                              Source: FirefoxExtension.xpi.5.drZip Entry: js/content.js
                              Source: FirefoxExtension.xpi.5.drZip Entry: js/popup.js
                              Source: embed_bcfs.zip.5.drZip Entry: assets/index-be2a7f67.js
                              Source: embed_bcfs_full.zip.5.drZip Entry: assets/index-2f1e175b.js
                              Source: embed_bcsp.zip.5.drZip Entry: assets/index-710fe85a.js
                              Source: embed_bcxt.zip.5.drZip Entry: assets/index-8e5ef939.js
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00CEF920 GetModuleHandleW,GetProcAddress,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,NtQueryInformationProcess,GetCurrentProcess,NtQueryInformationProcess,12_2_00CEF920
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00CEBDA0 NtQueryInformationProcess,GetModuleHandleW,GetProcAddress,GetLastError,GetLastError,NtQueryInformationProcess,Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error,12_2_00CEBDA0
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00CEBE60 NtQueryInformationProcess,12_2_00CEBE60
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_00636220: GetCurrentProcessId,GetCurrentThreadId,CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,DeviceIoControl,DeviceIoControl,10_2_00636220
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00CED120 DuplicateTokenEx,CreateProcessAsUserW,CloseHandle,GetLastError,Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error,GetLastError,Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error,GetLastError,12_2_00CED120
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeCode function: 5_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,5_2_004034A5
                              Source: C:\Windows\System32\svchost.exeFile created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeCode function: 5_2_00404DCC5_2_00404DCC
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeCode function: 5_2_00406AF25_2_00406AF2
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeCode function: 8_2_0040AC108_2_0040AC10
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeCode function: 8_2_0040AED78_2_0040AED7
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeCode function: 8_2_0040B77E8_2_0040B77E
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeCode function: 8_2_0040BB8A8_2_0040BB8A
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeCode function: 8_2_0040B3AA8_2_0040B3AA
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeCode function: 8_2_0040BFAA8_2_0040BFAA
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_00634F5010_2_00634F50
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_00638FB010_2_00638FB0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_006370D910_2_006370D9
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_0063F11010_2_0063F110
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_006573B010_2_006573B0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_0066D54010_2_0066D540
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_0067184010_2_00671840
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_00653AC010_2_00653AC0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_0066FFE010_2_0066FFE0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_0066819010_2_00668190
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_006783A010_2_006783A0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_0066A54010_2_0066A540
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_0068066010_2_00680660
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_006B860910_2_006B8609
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_0061A61010_2_0061A610
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_006747C010_2_006747C0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_006C68E010_2_006C68E0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_006728A010_2_006728A0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_006A091910_2_006A0919
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_006C099210_2_006C0992
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_006C0AB210_2_006C0AB2
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_006A0B4B10_2_006A0B4B
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_00612B0010_2_00612B00
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_00676D4310_2_00676D43
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_0069ADD010_2_0069ADD0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_006A0DB010_2_006A0DB0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_00648EA010_2_00648EA0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_0061CF4010_2_0061CF40
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_0066F15010_2_0066F150
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_0065D2C010_2_0065D2C0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_006AB34010_2_006AB340
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_006A933A10_2_006A933A
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_0061540010_2_00615400
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_0067B4F010_2_0067B4F0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_006B14AF10_2_006B14AF
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_0067760210_2_00677602
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_0061F83010_2_0061F830
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_006BD8E010_2_006BD8E0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_006A390B10_2_006A390B
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_00673A3010_2_00673A30
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_0064FB4010_2_0064FB40
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_00643C5010_2_00643C50
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_0063BCB010_2_0063BCB0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_00617D1010_2_00617D10
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 11_2_000A52F011_2_000A52F0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 11_2_000ABB7011_2_000ABB70
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 11_2_000BC9D011_2_000BC9D0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 11_2_000C126C11_2_000C126C
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 11_2_000AD34011_2_000AD340
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 11_2_000AEDE011_2_000AEDE0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 11_2_000BCE7E11_2_000BCE7E
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 11_2_000B66E411_2_000B66E4
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D2C3C012_2_00D2C3C0
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D1E53012_2_00D1E530
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D3678012_2_00D36780
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D3AC4012_2_00D3AC40
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D00F0012_2_00D00F00
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D3D1D012_2_00D3D1D0
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D4523012_2_00D45230
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D1B42012_2_00D1B420
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D35CA012_2_00D35CA0
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D5FFB012_2_00D5FFB0
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D0606012_2_00D06060
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D9614812_2_00D96148
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00CE027012_2_00CE0270
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00CE239012_2_00CE2390
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00CEA37012_2_00CEA370
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D5C5C012_2_00D5C5C0
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00DA85FD12_2_00DA85FD
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D8C5E312_2_00D8C5E3
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D0250012_2_00D02500
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00CCC53012_2_00CCC530
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D6888012_2_00D68880
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00CCA8B012_2_00CCA8B0
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00CE29D012_2_00CE29D0
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00CDE94012_2_00CDE940
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D2A96012_2_00D2A960
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00CE4AC012_2_00CE4AC0
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D38CA012_2_00D38CA0
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D8AC0012_2_00D8AC00
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D5CD0012_2_00D5CD00
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D42D2012_2_00D42D20
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D84E4012_2_00D84E40
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00DB0F4312_2_00DB0F43
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00CC100012_2_00CC1000
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D8118012_2_00D81180
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D1D21012_2_00D1D210
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D5F21012_2_00D5F210
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00DA938312_2_00DA9383
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00CE332012_2_00CE3320
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D414D012_2_00D414D0
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00CE140012_2_00CE1400
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D8140012_2_00D81400
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D9D6B012_2_00D9D6B0
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D0D6A012_2_00D0D6A0
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D8175012_2_00D81750
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D9B70212_2_00D9B702
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D1D8C012_2_00D1D8C0
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00CDD95012_2_00CDD950
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D2FAD012_2_00D2FAD0
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00CE5AB012_2_00CE5AB0
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D5DBD012_2_00D5DBD0
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D25B2012_2_00D25B20
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D61C5012_2_00D61C50
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00CFBC3012_2_00CFBC30
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D5BD8012_2_00D5BD80
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D95DBA12_2_00D95DBA
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D85EE012_2_00D85EE0
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D85FD012_2_00D85FD0
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00CF9FF012_2_00CF9FF0
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00CDDF8012_2_00CDDF80
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00CE1F1012_2_00CE1F10
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00CCBF2012_2_00CCBF20
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D13F2012_2_00D13F20
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: String function: 00CE7460 appears 92 times
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: String function: 00CD8750 appears 52 times
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: String function: 00D6D5B0 appears 41 times
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: String function: 00CE8120 appears 36 times
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: String function: 00698713 appears 374 times
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: String function: 00698DFE appears 111 times
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: String function: 00621BE0 appears 67 times
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: String function: 006B4231 appears 31 times
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: String function: 006985BF appears 56 times
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: String function: 00698E31 appears 79 times
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: String function: 00658650 appears 192 times
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: String function: 00699600 appears 61 times
                              Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 6740 -ip 6740
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp.0.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
                              Source: BitComet.exe.5.drStatic PE information: Resource name: DLL type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                              Source: BitComet.exe.5.drStatic PE information: Resource name: ZIP type: Zip archive data, at least v2.0 to extract, compression method=deflate
                              Source: BitComet.exe.5.drStatic PE information: Resource name: ZIP type: Zip archive data, at least v2.0 to extract, compression method=deflate
                              Source: BitComet.exe.5.drStatic PE information: Resource name: ZIP type: Zip archive data, at least v2.0 to extract, compression method=deflate
                              Source: BitComet.exe.5.drStatic PE information: Resource name: ZIP type: Zip archive data, at least v2.0 to extract, compression method=deflate
                              Source: BitComet.exe.5.drStatic PE information: Resource name: ZIP type: Zip archive data, at least v2.0 to extract, compression method=deflate
                              Source: BitComet.exe.5.drStatic PE information: Resource name: ZIP type: Zip archive data, at least v2.0 to extract, compression method=deflate
                              Source: BitComet.exe.5.drStatic PE information: Resource name: ZIP type: Zip archive data, at least v2.0 to extract, compression method=deflate
                              Source: installer.exe.10.drStatic PE information: Resource name: PAYLOAD type: Microsoft Cabinet archive data, many, 28277285 bytes, 132 files, at 0x2c +A "analyticsmanager.cab" +A "analyticstelemetry.cab", number 1, 993 datablocks, 0x1 compression
                              Source: aswOfferTool.exe.39.drStatic PE information: Resource name: FILE type: PE32 executable (DLL) (console) Intel 80386, for MS Windows
                              Source: installer.exe.40.drStatic PE information: Resource name: DLL type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                              Source: WebView2Loader.dll.5.drStatic PE information: Number of sections : 12 > 10
                              Source: resource.dll.40.drStatic PE information: No import functions for PE file found
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe, 00000000.00000003.1700603344.000000007FB50000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFileName vs SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe, 00000000.00000003.2649478318.00000000022D8000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamekernel32j% vs SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe, 00000000.00000003.1698345675.00000000026B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFileName vs SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe, 00000000.00000000.1694935808.00000000004C6000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFileName vs SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpKey value queried: HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon versionJump to behavior
                              Source: classification engineClassification label: mal46.rans.troj.evad.winEXE@65/491@81/16
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeCode function: 5_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,5_2_004034A5
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00CEFAA0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,12_2_00CEFAA0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeCode function: 5_2_00404850 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,5_2_00404850
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_00624C8E GetCurrentProcessId,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,FindCloseChangeNotification,10_2_00624C8E
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeCode function: 5_2_00402104 CoCreateInstance,5_2_00402104
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeCode function: 8_2_00409D65 FindResourceW,FindResourceW,LoadResource,LoadResource,LockResource,FindResourceW,LoadResource,LockResource,GetWindow,GlobalAlloc,GlobalLock,GlobalUnlock,CreateStreamOnHGlobal,MapDialogRect,SetWindowContextHelpId,SetWindowPos,SysFreeString,GetWindow,SysFreeString,8_2_00409D65
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeFile created: C:\Program Files\BitCometJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpFile created: C:\Users\user\AppData\Local\ProgramsJump to behavior
                              Source: C:\Program Files\BitComet\tools\UPNP.exeMutant created: \Sessions\1\BaseNamedObjects\{UPNP-ICF-A4AFA740-F3D0-4efc-B4BA-86948F1185D5}
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpMutant created: \Sessions\1\BaseNamedObjects\{08eb55fb-ff61-4fb7-8e9d-c036008acc06}Installer
                              Source: C:\Program Files\BitComet\tools\UPNP.exeMutant created: NULL
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpMutant created: \Sessions\1\BaseNamedObjects\Global\{08eb55fb-ff61-4fb7-8e9d-c036008acc06}Installer
                              Source: C:\Program Files\BitComet\tools\UPNP.exeMutant created: \Sessions\1\BaseNamedObjects\{UPNP-NAT-0C3AE491-163B-4752-A532-E2383776602D}
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeMutant created: \Sessions\1\BaseNamedObjects\Global\e5d51690dec58ca5e0a518c5e0dea31c
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeMutant created: \Sessions\1\BaseNamedObjects\Global\{48ca68e-e4ff-43ac-a993-6d162f33de7c}
                              Source: C:\Program Files\BitComet\BitComet.exeMutant created: \Sessions\1\BaseNamedObjects\75DAD82D-A77F-49e5-ADD3-8F11C1940689
                              Source: C:\Program Files\BitComet\BitComet.exeMutant created: \Sessions\1\BaseNamedObjects\{SIMPLEBT-53DE14D9-A616-4ff0-BA62-9DF424D0665C}
                              Source: C:\Program Files\BitComet\tools\BitCometService.exeMutant created: \BaseNamedObjects\75DAD82D-A77F-49e5-ADD3-8F11C1940689
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeMutant created: \Sessions\1\BaseNamedObjects\Global\{32B25EF2-80FD-4C66-97E1-0890D9E9F87B}
                              Source: C:\Program Files\BitComet\BitComet.exeMutant created: \Sessions\1\BaseNamedObjects\{SIMPLEBT-D19EACFB-5FD1-4615-A179-A9B9E38A6506}
                              Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6740
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeMutant created: \Sessions\1\BaseNamedObjects\Global\494f9fb603da4b2ac88f6f0b075abb5e
                              Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.OfferCore.5002.4698.exeFile created: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmpJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: /silent11_2_000A52F0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: /cookie11_2_000A52F0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: /ppi_icd11_2_000A52F0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: /cust_ini11_2_000A52F0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: Enabled11_2_000A52F0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: ProxySettings11_2_000A52F0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: ProxyType11_2_000A52F0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: ProxySettings11_2_000A52F0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: ProxySettings11_2_000A52F0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: Port11_2_000A52F0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: ProxySettings11_2_000A52F0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: User11_2_000A52F0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: ProxySettings11_2_000A52F0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: Password11_2_000A52F0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: ProxySettings11_2_000A52F0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: ProxySettings11_2_000A52F0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: Properties11_2_000A52F0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: /smbupd11_2_000A52F0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: enable11_2_000A52F0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: mirror11_2_000A52F0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: count11_2_000A52F0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: servers11_2_000A52F0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: urlpgm11_2_000A52F0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: server011_2_000A52F0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: http://11_2_000A52F0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: https://11_2_000A52F0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: allow_fallback11_2_000A52F0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: mirror11_2_000A52F0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: installer.exe11_2_000A52F0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: {versionSwitch}11_2_000A52F0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: stable11_2_000A52F0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCommand line argument: %s\%s11_2_000A52F0
                              Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.OfferCore.5002.4698.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                              Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.OfferCore.5002.4698.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpFile read: C:\Users\desktop.iniJump to behavior
                              Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.OfferCore.5002.4698.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganizationJump to behavior
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeFile read: C:\Windows\System32\drivers\etc\hosts
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeFile read: C:\Windows\System32\drivers\etc\hosts
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile read: C:\Windows\System32\drivers\etc\hosts
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile read: C:\Windows\System32\drivers\etc\hosts
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile read: C:\Windows\System32\drivers\etc\hosts
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile read: C:\Windows\System32\drivers\etc\hosts
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile read: C:\Windows\System32\drivers\etc\hosts
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile read: C:\Windows\System32\drivers\etc\hosts
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile read: C:\Windows\System32\drivers\etc\hosts
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile read: C:\Windows\System32\drivers\etc\hosts
                              Source: BitComet.exe, 0000000D.00000002.2420857876.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmp, BitComet.exe, 0000000D.00000000.2403166450.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
                              Source: BitComet.exe, 0000000D.00000002.2420857876.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmp, BitComet.exe, 0000000D.00000000.2403166450.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmpBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
                              Source: BitComet.exe, 0000000D.00000002.2420857876.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmp, BitComet.exe, 0000000D.00000000.2403166450.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmpBinary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
                              Source: BitComet.exe, 0000000D.00000002.2420857876.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmp, BitComet.exe, 0000000D.00000000.2403166450.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
                              Source: BitComet.exe, 0000000D.00000002.2420857876.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmp, BitComet.exe, 0000000D.00000000.2403166450.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmpBinary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
                              Source: BitComet.exe, 0000000D.00000002.2420857876.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmp, BitComet.exe, 0000000D.00000000.2403166450.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmpBinary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
                              Source: BitComet.exe, 0000000D.00000002.2420857876.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmp, BitComet.exe, 0000000D.00000000.2403166450.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmpBinary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.exeReversingLabs: Detection: 18%
                              Source: BitComet_2.08a_setup.exeString found in binary or memory: "C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe" https://www.bitcomet.com/client/install-stats/?l=en_us&file=Bit
                              Source: BitComet_2.08a_setup.exeString found in binary or memory: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe" https://www.bitcomet.com/client/install-stats/?l=en_us&file=BitC
                              Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.OfferCore.5002.4698.exeFile read: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.OfferCore.5002.4698.exeJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeEvasive API call chain: GetCommandLine,DecisionNodes,ExitProcessgraph_8-6208
                              Source: unknownProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe "C:\Users\user\Desktop\SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe"
                              Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.OfferCore.5002.4698.exeProcess created: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp "C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp" /SL5="$10418,1635575,878080,C:\Users\user\Desktop\SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe"
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe "C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe" /S
                              Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeProcess created: C:\Program Files\BitComet\tools\BitCometService.exe "C:\Program Files\BitComet\tools\BitCometService.exe" /reg
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeProcess created: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe "C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe" https://www.bitcomet.com/client/install-stats/?l=en_us&file=BitComet_2.08a_setup.exe&p=x64
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exe "C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exe" /affid 91088 PaidDistribution=true CountryCode=US
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exe "C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exe" /silent /ws /psh:92pTu5fbOaMVqHXWzRazGwcsjZOgyQNZV0BXrS1y4TWZ27PXSitlzA5vE30PraTCAoRM4emN7pEfhI
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeProcess created: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe "C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe" /silent /ws /psh:92pTu5fbOaMVqHXWzRazGwcsjZOgyQNZV0BXrS1y4TWZ27PXSitlzA5vE30PraTCAoRM4emN7pEfhI /cookie:mmm_irs_ppi_902_451_o /ga_clientid:1840c678-d62a-4945-8e4f-36eaf3f0c4a5 /edat_dir:C:\Windows\Temp\asw.481015ae89dc80a3
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess created: C:\Program Files\BitComet\BitComet.exe "C:\Program Files\BitComet\BitComet.exe" --no_elevated
                              Source: unknownProcess created: C:\Program Files\BitComet\BitComet.exe "C:\Program Files\BitComet\BitComet.exe"
                              Source: unknownProcess created: C:\Program Files\BitComet\tools\BitCometService.exe "C:\Program Files\BitComet\tools\BitCometService.exe" -service
                              Source: C:\Program Files\BitComet\BitComet.exeProcess created: C:\Program Files\BitComet\tools\UPNP.exe "C:\Program Files\BitComet\tools\UPNP.exe" -addfw -app BitComet -tcpport 9652 -udpport 9652 -q
                              Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
                              Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 6740 -ip 6740
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6740 -s 968
                              Source: C:\Program Files\BitComet\BitComet.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=6032.3612.7348265561393428437
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Local\BitComet\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Local\BitComet\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x15c,0x160,0x164,0x138,0x170,0x7ffdfab78e88,0x7ffdfab78e98,0x7ffdfab78ea8
                              Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2484 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:2
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2924 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:3
                              Source: C:\Program Files\BitComet\BitComet.exeProcess created: C:\Program Files\BitComet\tools\UPNP.exe "C:\Program Files\BitComet\tools\UPNP.exe" -add -app BitComet -lanip 192.168.2.4 -tcpport 9652 -udpport 9652 -q
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2920 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:8
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6693313984 --mojo-platform-channel-handle=3272 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:1
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6693485965 --mojo-platform-channel-handle=3588 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:1
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6693635288 --mojo-platform-channel-handle=3776 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:1
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6693754114 --mojo-platform-channel-handle=4048 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:1
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --disable-gpu-compositing --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6697808392 --mojo-platform-channel-handle=4692 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:1
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --disable-gpu-compositing --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6698303265 --mojo-platform-channel-handle=4760 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:1
                              Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 6740 -ip 6740
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6740 -s 968
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeProcess created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\icarus-info.xml /install /silent /ws /psh:92pTu5fbOaMVqHXWzRazGwcsjZOgyQNZV0BXrS1y4TWZ27PXSitlzA5vE30PraTCAoRM4emN7pEfhI /cookie:mmm_irs_ppi_902_451_o /edat_dir:C:\Windows\Temp\asw.481015ae89dc80a3 /track-guid:1840c678-d62a-4945-8e4f-36eaf3f0c4a5
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeProcess created: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe "C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\\installer.exe" /setOem:Affid=91088 /s /thirdparty /upgrade
                              Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.OfferCore.5002.4698.exeProcess created: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp "C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp" /SL5="$10418,1635575,878080,C:\Users\user\Desktop\SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe" Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe "C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe" /SJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exe "C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exe" /affid 91088 PaidDistribution=true CountryCode=USJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exe "C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exe" /silent /ws /psh:92pTu5fbOaMVqHXWzRazGwcsjZOgyQNZV0BXrS1y4TWZ27PXSitlzA5vE30PraTCAoRM4emN7pEfhIJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess created: C:\Program Files\BitComet\BitComet.exe "C:\Program Files\BitComet\BitComet.exe" --no_elevatedJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeProcess created: C:\Program Files\BitComet\tools\BitCometService.exe "C:\Program Files\BitComet\tools\BitCometService.exe" /regJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeProcess created: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe "C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe" https://www.bitcomet.com/client/install-stats/?l=en_us&file=BitComet_2.08a_setup.exe&p=x64Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeProcess created: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe "C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\\installer.exe" /setOem:Affid=91088 /s /thirdparty /upgrade Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeProcess created: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe "C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe" /silent /ws /psh:92pTu5fbOaMVqHXWzRazGwcsjZOgyQNZV0BXrS1y4TWZ27PXSitlzA5vE30PraTCAoRM4emN7pEfhI /cookie:mmm_irs_ppi_902_451_o /ga_clientid:1840c678-d62a-4945-8e4f-36eaf3f0c4a5 /edat_dir:C:\Windows\Temp\asw.481015ae89dc80a3
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeProcess created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\icarus-info.xml /install /silent /ws /psh:92pTu5fbOaMVqHXWzRazGwcsjZOgyQNZV0BXrS1y4TWZ27PXSitlzA5vE30PraTCAoRM4emN7pEfhI /cookie:mmm_irs_ppi_902_451_o /edat_dir:C:\Windows\Temp\asw.481015ae89dc80a3 /track-guid:1840c678-d62a-4945-8e4f-36eaf3f0c4a5
                              Source: C:\Program Files\BitComet\BitComet.exeProcess created: C:\Program Files\BitComet\tools\UPNP.exe "C:\Program Files\BitComet\tools\UPNP.exe" -addfw -app BitComet -tcpport 9652 -udpport 9652 -q
                              Source: C:\Program Files\BitComet\BitComet.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=6032.3612.7348265561393428437
                              Source: C:\Program Files\BitComet\BitComet.exeProcess created: C:\Program Files\BitComet\tools\UPNP.exe "C:\Program Files\BitComet\tools\UPNP.exe" -add -app BitComet -lanip 192.168.2.4 -tcpport 9652 -udpport 9652 -q
                              Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 6740 -ip 6740
                              Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6740 -s 968
                              Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 6740 -ip 6740
                              Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6740 -s 968
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess created: unknown unknown
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Local\BitComet\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Local\BitComet\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x15c,0x160,0x164,0x138,0x170,0x7ffdfab78e88,0x7ffdfab78e98,0x7ffdfab78ea8
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2484 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:2
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2924 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:3
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2920 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:8
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6693313984 --mojo-platform-channel-handle=3272 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:1
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6693485965 --mojo-platform-channel-handle=3588 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:1
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6693635288 --mojo-platform-channel-handle=3776 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:1
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6693754114 --mojo-platform-channel-handle=4048 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:1
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --disable-gpu-compositing --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6697808392 --mojo-platform-channel-handle=4692 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:1
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --disable-gpu-compositing --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6698303265 --mojo-platform-channel-handle=4760 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:1
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess created: unknown unknown
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeProcess created: unknown unknown
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeProcess created: unknown unknown
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeProcess created: unknown unknown
                              Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.OfferCore.5002.4698.exeSection loaded: version.dllJump to behavior
                              Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.OfferCore.5002.4698.exeSection loaded: netapi32.dllJump to behavior
                              Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.OfferCore.5002.4698.exeSection loaded: netutils.dllJump to behavior
                              Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.OfferCore.5002.4698.exeSection loaded: uxtheme.dllJump to behavior
                              Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.OfferCore.5002.4698.exeSection loaded: apphelp.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: mpr.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: version.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: netapi32.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: winhttp.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: netutils.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: uxtheme.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: wtsapi32.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: winsta.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: textinputframework.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: coreuicomponents.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: coremessaging.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: ntmarta.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: wintypes.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: wintypes.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: wintypes.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: textshaping.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: dwmapi.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: windows.storage.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: wldp.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: profapi.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: shfolder.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: rstrtmgr.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: ncrypt.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: ntasn1.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: msimg32.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: oleacc.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: winmm.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: winhttpcom.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: ondemandconnroutehelper.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: webio.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: mswsock.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: iphlpapi.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: winnsi.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: sspicli.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: dnsapi.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: rasadhlp.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: fwpuclnt.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: schannel.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: mskeyprotect.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: ncryptsslp.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: msasn1.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: cryptsp.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: rsaenh.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: cryptbase.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: gpapi.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: dpapi.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: ondemandconnroutehelper.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: msftedit.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: windows.globalization.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: bcp47langs.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: bcp47mrm.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: globinputhost.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: ondemandconnroutehelper.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: dhcpcsvc6.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: dhcpcsvc.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: windowscodecs.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: dataexchange.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: d3d11.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: dcomp.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: dxgi.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: twinapi.appcore.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: explorerframe.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: apphelp.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: sxs.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: propsys.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: zipfldr.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: edputil.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: windows.staterepositoryps.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: windows.fileexplorer.common.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: shdocvw.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: urlmon.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: iertutil.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: srvcli.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: userenv.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: appresolver.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: slc.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: userenv.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: sppc.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: onecorecommonproxystub.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: uxtheme.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: userenv.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: apphelp.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: propsys.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: dwmapi.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: cryptbase.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: oleacc.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: version.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: shfolder.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: windows.storage.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: wldp.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: profapi.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: msimg32.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: oledlg.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: winmm.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: msimg32.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: oledlg.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: winmm.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: msimg32.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: oledlg.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: winmm.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: msimg32.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: oledlg.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: winmm.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: msimg32.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: oledlg.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: winmm.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: msimg32.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: oledlg.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: winmm.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: msimg32.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: oledlg.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: winmm.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: msimg32.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: oledlg.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: winmm.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: sspicli.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: winmm.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: msimg32.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: oledlg.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: winmm.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: firewallapi.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: dnsapi.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: iphlpapi.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: fwbase.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: fwpolicyiomgr.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: msimg32.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: oledlg.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: winmm.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: ntmarta.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: edputil.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: urlmon.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: iertutil.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: srvcli.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: netutils.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: wintypes.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: appresolver.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: bcp47langs.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: slc.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: sppc.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: linkinfo.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: ntshrui.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeSection loaded: cscapi.dllJump to behavior
                              Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Windows\System32\svchost.exeSection loaded: licensemanagersvc.dllJump to behavior
                              Source: C:\Windows\System32\svchost.exeSection loaded: licensemanager.dllJump to behavior
                              Source: C:\Windows\System32\svchost.exeSection loaded: clipc.dllJump to behavior
                              Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dllJump to behavior
                              Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dllJump to behavior
                              Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dllJump to behavior
                              Source: C:\Program Files\BitComet\tools\BitCometService.exeSection loaded: apphelp.dllJump to behavior
                              Source: C:\Program Files\BitComet\tools\BitCometService.exeSection loaded: winmm.dllJump to behavior
                              Source: C:\Program Files\BitComet\tools\BitCometService.exeSection loaded: version.dllJump to behavior
                              Source: C:\Program Files\BitComet\tools\BitCometService.exeSection loaded: ntmarta.dllJump to behavior
                              Source: C:\Program Files\BitComet\tools\BitCometService.exeSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: apphelp.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: uxtheme.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: ieframe.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: iertutil.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: netapi32.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: version.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: userenv.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: winhttp.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: wkscli.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: netutils.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: dataexchange.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: d3d11.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: dcomp.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: dxgi.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: twinapi.appcore.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: windows.storage.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: wldp.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: propsys.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: urlmon.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: srvcli.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: sxs.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: textinputframework.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: coreuicomponents.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: coremessaging.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: ntmarta.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: wintypes.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: wintypes.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: wintypes.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: msiso.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: sspicli.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: wininet.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: profapi.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: mswsock.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: iphlpapi.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: winnsi.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: mshtml.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: powrprof.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: umpdc.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: cryptbase.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: dnsapi.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: rasadhlp.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: fwpuclnt.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeSection loaded: schannel.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: apphelp.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: acgenral.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: uxtheme.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: winmm.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: samcli.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: msacm32.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: version.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: userenv.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: dwmapi.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: urlmon.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: mpr.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: sspicli.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: winmmbase.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: winmmbase.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: iertutil.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: srvcli.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: netutils.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: aclayers.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: sfc.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: sfc_os.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: windows.storage.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: wldp.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: profapi.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: wtsapi32.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: winsta.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: winhttp.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: webio.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: mswsock.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: iphlpapi.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: winnsi.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: dnsapi.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: rasadhlp.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: fwpuclnt.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: schannel.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: mskeyprotect.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: ntasn1.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: ncrypt.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: ncryptsslp.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: msasn1.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: cryptsp.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: rsaenh.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: cryptbase.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: gpapi.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: dpapi.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: dhcpcsvc6.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: dhcpcsvc.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeSection loaded: cryptnet.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: cryptsp.dll
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: rsaenh.dll
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: cryptbase.dll
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: version.dll
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: kernel.appcore.dll
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: netprofm.dll
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: npmproxy.dll
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: winhttp.dll
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: ondemandconnroutehelper.dll
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: webio.dll
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: mswsock.dll
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: iphlpapi.dll
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: winnsi.dll
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: msasn1.dll
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: sspicli.dll
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: dnsapi.dll
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: rasadhlp.dll
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: fwpuclnt.dll
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: schannel.dll
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: mskeyprotect.dll
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: ntasn1.dll
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: ncrypt.dll
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: ncryptsslp.dll
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: msasn1.dll
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: gpapi.dll
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: dpapi.dll
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: ondemandconnroutehelper.dll
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeSection loaded: apphelp.dll
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeSection loaded: kernel.appcore.dll
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeSection loaded: version.dll
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeSection loaded: windows.storage.dll
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeSection loaded: wldp.dll
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeSection loaded: profapi.dll
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeSection loaded: cryptsp.dll
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeSection loaded: rsaenh.dll
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeSection loaded: cryptbase.dll
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeSection loaded: dpapi.dll
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeSection loaded: winhttp.dll
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeSection loaded: ondemandconnroutehelper.dll
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeSection loaded: mswsock.dll
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeSection loaded: iphlpapi.dll
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeSection loaded: winnsi.dll
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeSection loaded: dhcpcsvc6.dll
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeSection loaded: dhcpcsvc.dll
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeSection loaded: webio.dll
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeSection loaded: sspicli.dll
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeSection loaded: dnsapi.dll
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeSection loaded: rasadhlp.dll
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeSection loaded: fwpuclnt.dll
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeSection loaded: schannel.dll
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeSection loaded: mskeyprotect.dll
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeSection loaded: ntasn1.dll
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeSection loaded: ncrypt.dll
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeSection loaded: ncryptsslp.dll
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeSection loaded: msasn1.dll
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeSection loaded: gpapi.dll
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeSection loaded: ondemandconnroutehelper.dll
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeSection loaded: ondemandconnroutehelper.dll
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeSection loaded: ondemandconnroutehelper.dll
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeSection loaded: ondemandconnroutehelper.dll
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeSection loaded: ondemandconnroutehelper.dll
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeSection loaded: ondemandconnroutehelper.dll
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeSection loaded: ntmarta.dll
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeSection loaded: ondemandconnroutehelper.dll
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeSection loaded: apphelp.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: apphelp.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: uxtheme.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: winmm.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: urlmon.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: wininet.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: iphlpapi.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: msimg32.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: version.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: oleacc.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: iertutil.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: srvcli.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: netutils.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: kernel.appcore.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: windows.storage.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: wldp.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: profapi.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: dbghelp.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: taskschd.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: sspicli.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: xmllite.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: uxtheme.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: winmm.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: urlmon.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: wininet.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: iphlpapi.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: msimg32.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: version.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: oleacc.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: iertutil.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: srvcli.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: netutils.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: kernel.appcore.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: windows.storage.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: wldp.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: profapi.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: dbghelp.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: mswsock.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: cryptsp.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: rsaenh.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: cryptbase.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: sspicli.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: ondemandconnroutehelper.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: winhttp.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: winnsi.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: dhcpcsvc6.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: dhcpcsvc.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: dnsapi.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: rasadhlp.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: fwpuclnt.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: propsys.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: edputil.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: windows.staterepositoryps.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: wintypes.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: appresolver.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: bcp47langs.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: slc.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: userenv.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: sppc.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: onecorecommonproxystub.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: onecoreuapcommonproxystub.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: apphelp.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: firewallapi.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: fwbase.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: fwpolicyiomgr.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: linkinfo.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: textshaping.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: webview2loader.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: windowscodecs.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: thumbcache.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: policymanager.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: msvcp110_win.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: dataexchange.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: d3d11.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: dcomp.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: dxgi.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: twinapi.appcore.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: textinputframework.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: coreuicomponents.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: coremessaging.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: ntmarta.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: coremessaging.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: ntshrui.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: cscapi.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: taskflowdataengine.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: cdp.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: umpdc.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: dsreg.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: dwmapi.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: explorerframe.dll
                              Source: C:\Program Files\BitComet\BitComet.exeSection loaded: dbghelp.dll
                              Source: C:\Program Files\BitComet\tools\BitCometService.exeSection loaded: winmm.dll
                              Source: C:\Program Files\BitComet\tools\BitCometService.exeSection loaded: version.dll
                              Source: C:\Program Files\BitComet\tools\BitCometService.exeSection loaded: kernel.appcore.dll
                              Source: C:\Program Files\BitComet\tools\UPNP.exeSection loaded: apphelp.dll
                              Source: C:\Program Files\BitComet\tools\UPNP.exeSection loaded: version.dll
                              Source: C:\Program Files\BitComet\tools\UPNP.exeSection loaded: winmm.dll
                              Source: C:\Program Files\BitComet\tools\UPNP.exeSection loaded: wininet.dll
                              Source: C:\Program Files\BitComet\tools\UPNP.exeSection loaded: kernel.appcore.dll
                              Source: C:\Program Files\BitComet\tools\UPNP.exeSection loaded: uxtheme.dll
                              Source: C:\Program Files\BitComet\tools\UPNP.exeSection loaded: firewallapi.dll
                              Source: C:\Program Files\BitComet\tools\UPNP.exeSection loaded: dnsapi.dll
                              Source: C:\Program Files\BitComet\tools\UPNP.exeSection loaded: iphlpapi.dll
                              Source: C:\Program Files\BitComet\tools\UPNP.exeSection loaded: fwbase.dll
                              Source: C:\Program Files\BitComet\tools\UPNP.exeSection loaded: fwpolicyiomgr.dll
                              Source: C:\Program Files\BitComet\tools\UPNP.exeSection loaded: hnetcfg.dll
                              Source: C:\Program Files\BitComet\tools\UPNP.exeSection loaded: atl.dll
                              Source: C:\Program Files\BitComet\tools\UPNP.exeSection loaded: iphlpapi.dll
                              Source: C:\Program Files\BitComet\tools\UPNP.exeSection loaded: userenv.dll
                              Source: C:\Program Files\BitComet\tools\UPNP.exeSection loaded: gpapi.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: wersvc.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: windowsperformancerecordercontrol.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: weretw.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: wer.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: faultrep.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: dbghelp.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: dbgcore.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: wer.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32Jump to behavior
                              Source: BitComet.lnk.5.drLNK file: ..\..\..\..\..\..\Program Files\BitComet\BitComet.exe
                              Source: HomePage.lnk.5.drLNK file: ..\..\..\..\..\..\Program Files\BitComet\BitComet.url
                              Source: Uninstall.lnk.5.drLNK file: ..\..\..\..\..\..\Program Files\BitComet\uninst.exe
                              Source: BitComet.lnk0.5.drLNK file: ..\..\..\Program Files\BitComet\BitComet.exe
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile written: C:\ProgramData\AVG\Icarus\settings\proxy.ini
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwnerJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpWindow found: window name: TSelectLanguageFormJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpAutomated click: OK
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpAutomated click: Next
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpAutomated click: Accept
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpAutomated click: Accept
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpAutomated click: Next
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpAutomated click: Next
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpAutomated click: Next
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpAutomated click: Next
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpAutomated click: Next
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpFile opened: C:\Windows\SysWOW64\MSFTEDIT.DLLJump to behavior
                              Source: Window RecorderWindow detected: More than 3 window changes detected
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpWindow detected: HYPERLINK "http://www.bitcomet.com/doc/term-of-use.php" End User License AgreementHYPERLINK "https://www.bitcomet.com/doc/privacy-policy.php" Privacy PolicyThis will install BitComet to your computer click "Next" to continue.BitComet is a free BitTorrent download client! BitComet is powerful super-fast and easy-to-use.Welcome to BitComet Installer&NextCancel
                              Source: C:\Program Files\BitComet\BitComet.exeWindow detected: Number of UI elements: 40
                              Source: C:\Program Files\BitComet\BitComet.exeWindow detected: Number of UI elements: 40
                              Source: C:\Program Files\BitComet\BitComet.exeWindow detected: Number of UI elements: 40
                              Source: C:\Program Files\BitComet\BitComet.exeWindow detected: Number of UI elements: 40
                              Source: C:\Program Files\BitComet\BitComet.exeWindow detected: Number of UI elements: 40
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitCometJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\ReadMe.txtJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\License.txtJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\ChangeLog.txtJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\BitComet.exeJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\CrashReport.exeJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\WebView2Loader.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\langJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-ar.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-bg.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-bs.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-ca.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-cs.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-da.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-de.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-el.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-en_US.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-es.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-et.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-eu.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-fa.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-fi.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-fr.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-gl.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-he.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-hr.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-hu.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-hy.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-id.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-it.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-ja.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-kk.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-kn.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-ko.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-ku.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-lt.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-lv.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-mk.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-ms.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-nb.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-ne.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-nl.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-pl.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-pt.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-pt_BR.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-ro.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-ru.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-sk.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-sl.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-sq.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-sr.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-sv.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-ta.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-th.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-tr.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-ug.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-uk.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-ur.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-vi.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-zh_CN.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\bitcomet-zh_TW.moJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\lang\HowTo-Translate.txtJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\ip2locationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\ip2location\ip2location.binJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\ip2location\ip2location-country-multilingual.csvJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\toolsJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\tools\UPNP.exeJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\tools\VideoSnapshot.exeJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\tools\Updater.exeJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\tools\BitCometToastsNotifier.exeJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\tools\BitCometToastsNotifier.pngJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\tools\ChromeLauncher.exeJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\tools\ChromeLauncherManifest.jsonJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\tools\ChromeExtension.crxJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\tools\EdgeExtension.crxJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\tools\FirefoxLauncherManifest.jsonJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\tools\FirefoxExtension.xpiJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\tools\BitCometAgent_1.92.7.9.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\tools\BitCometBHO_1.5.4.11.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\tools\BitCometService.exeJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\BitComet.urlJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDirectory created: C:\Program Files\BitComet\uninst.exeJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\analyticsmanager.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\analyticstelemetry.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\balloon_safe_annotation.png
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\browserhost.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\browserplugin.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\downloadscan.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\eventmanager.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\icon_complete.png
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\icon_failed.png
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\icon_laptop.png
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\installer.exe
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jquery-1.9.0.min.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\l10n.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\logicmodule.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\logicscripts.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\lookupmanager.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\main_close_large.png
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\mcafeecerts.xml
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\mcafee_pc_install_icon.png
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\mcafee_pc_install_icon2.png
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\mfw-mwb.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\mfw-nps.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\mfw-webadvisor.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\mfw.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\resource.dll
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\resourcedll.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\servicehost.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\settingmanager.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\taskmanager.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\telemetry.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\uihost.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\uimanager.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\uninstaller.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\updater.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\wa-common.css
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\wa-core.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\wa-install.css
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\wa-install.html
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\wa-ui-install.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\wa-utils.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\wataskmanager.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\wa_install_check.png
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\wa_install_check2.png
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\wa_install_close.png
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\wa_install_close2.png
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\wa_install_error.png
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\wa_logo.png
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\wa_logo2.png
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\webadvisor.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\webadvisor.ico
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\wssdep.cab
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-cs-CZ.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-da-DK.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-de-DE.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-el-GR.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-en-US.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-es-ES.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-es-MX.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-fi-FI.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-fr-CA.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-fr-FR.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-hr-HR.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-hu-HU.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-it-IT.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-ja-JP.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-ko-KR.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-nb-NO.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-nl-NL.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-pl-PL.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-pt-BR.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-pt-PT.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-ru-RU.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-sk-SK.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-sr-Latn-CS.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-sv-SE.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-tr-TR.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-zh-CN.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-zh-TW.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-cs-CZ.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-da-DK.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-de-DE.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-el-GR.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-en-US.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-es-ES.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-es-MX.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-fi-FI.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-fr-CA.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-fr-FR.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-hr-HR.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-hu-HU.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-it-IT.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-ja-JP.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-ko-KR.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-nb-NO.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-nl-NL.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-pl-PL.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-pt-BR.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-pt-PT.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-ru-RU.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-sk-SK.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-sr-Latn-CS.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-sv-SE.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-tr-TR.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-zh-CN.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-zh-TW.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-cs-CZ.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-da-DK.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-de-DE.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-el-GR.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-en-US.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-es-ES.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-es-MX.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-fi-FI.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-fr-CA.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-fr-FR.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-hr-HR.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-hu-HU.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-it-IT.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-ja-JP.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-ko-KR.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-nb-NO.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-nl-NL.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-pl-PL.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-pt-BR.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-pt-PT.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-ru-RU.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-sk-SK.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-sr-Latn-CS.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-sv-SE.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-tr-TR.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-zh-CN.js
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDirectory created: C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-zh-TW.js
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.exeStatic PE information: certificate valid
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.exeStatic file information: File size 2576200 > 1048576
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                              Source: Binary string: F:\develop\VideoSnap\app\Release_unicode\VideoSnapshot.pdb source: BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmp
                              Source: Binary string: E:\develop\BitCometAgent_ActiveX\app\Release_Unicode\BitCometAgent_ActiveX.pdb source: BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmp
                              Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x64\avDump.pdb= source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2539291834.0000000005D30000.00000004.00000020.00020000.00000000.sdmp
                              Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x86\icarus_mod.pdb source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2418861617.0000000005B49000.00000004.00000020.00020000.00000000.sdmp
                              Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x86\icarus_sfx.pdb source: avg_antivirus_free_online_setup.exe, 0000000C.00000002.2995522970.0000000005490000.00000002.00000001.00040000.00000018.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000000.2390280020.0000000000DC7000.00000002.00000001.01000000.00000018.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000002.2964747983.0000000000DC7000.00000002.00000001.01000000.00000018.sdmp
                              Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x64\icarus_ui.pdb source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2504355859.0000000006006000.00000004.00000020.00020000.00000000.sdmp
                              Source: Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\Win32\Release\SaBsi.pdb source: saBSI.exe, 0000000A.00000000.2344892193.00000000006DE000.00000002.00000001.01000000.00000016.sdmp, saBSI.exe, 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmp
                              Source: Binary string: E:\develop\tools\desktop-toasts\Release\BitCometToastsNotifier.pdb source: BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmp
                              Source: Binary string: C:\Source\Repos\DS-Platform\zbShield-Utils-CPP\zbShieldUtils\bin\Release\zbShieldUtils.pdb source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2405003876.00000000075E0000.00000004.00001000.00020000.00000000.sdmp
                              Source: Binary string: D:\develop\BitComet_2.08a\app\Release_unicode_x64\GUI_BitComet_wx.pdb source: BitComet.exe, 0000000D.00000002.2420857876.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmp, BitComet.exe, 0000000D.00000000.2403166450.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmp
                              Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x64\avDump.pdb source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2539291834.0000000005D30000.00000004.00000020.00020000.00000000.sdmp
                              Source: Binary string: d:\Develop\BitCometExtension_IE\app\release_unicode\BitCometBHO.pdb source: BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.000000000276B000.00000004.00000020.00020000.00000000.sdmp
                              Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x64\AvBugReport.pdb source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2577221124.0000000005DA0000.00000004.00000020.00020000.00000000.sdmp
                              Source: Binary string: D:\develop\CrashReport\CrashRpt_v3\bin\x64\Release LIB\CrashReport.pdbx source: BitComet.exe, 0000000D.00000003.2405439939.0000023E831E0000.00000004.00001000.00020000.00000000.sdmp
                              Source: Binary string: #F:\develop\VideoSnap\app\Release_unicode\VideoSnapshot.pdb source: BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmp
                              Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x64\icarus.pdb source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2450616405.0000000005E8C000.00000004.00000020.00020000.00000000.sdmp
                              Source: Binary string: C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x64\icarus.pdbU source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2450616405.0000000005E8C000.00000004.00000020.00020000.00000000.sdmp
                              Source: Binary string: C:\BUILD\work\8b0ebd312dc47f30\projects\avast\microstub\x86\Release\microstub.pdb source: avg_antivirus_free_setup.exe, 0000000B.00000000.2364390202.00000000000C3000.00000002.00000001.01000000.00000017.sdmp, avg_antivirus_free_setup.exe, 0000000B.00000002.2963084059.00000000000C3000.00000002.00000001.01000000.00000017.sdmp
                              Source: Binary string: D:\develop\CrashReport\CrashRpt_v3\bin\x64\Release LIB\CrashReport.pdb source: BitComet.exe, 0000000D.00000003.2405439939.0000023E831E0000.00000004.00001000.00020000.00000000.sdmp
                              Source: Binary string: E:\develop\BitCometExtension_Chrome\bc_launcher_for_chrome\Release\ChromeLauncher.pdb source: BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmp
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeCode function: 8_2_0040A15D IsProcessorFeaturePresent,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcessHeap,GetProcessHeap,HeapAlloc,InterlockedCompareExchange,GetProcessHeap,HeapFree,8_2_0040A15D
                              Source: uninst.exe.5.drStatic PE information: real checksum: 0x1a4dfb5 should be: 0x142315
                              Source: BitCometService.exe.5.drStatic PE information: real checksum: 0x294eeb should be: 0x294d8d
                              Source: BitCometService.exe0.5.drStatic PE information: real checksum: 0x294eeb should be: 0x294d8d
                              Source: System.dll.5.drStatic PE information: real checksum: 0x0 should be: 0x9091
                              Source: zbShieldUtils.dll.1.drStatic PE information: real checksum: 0x0 should be: 0x20647e
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp.0.drStatic PE information: real checksum: 0x0 should be: 0x2fb5da
                              Source: BcNsisHelperXP.dll.5.drStatic PE information: real checksum: 0x0 should be: 0x31b07
                              Source: BcNsisHelper.dll.5.drStatic PE information: real checksum: 0x0 should be: 0x3103df
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.exeStatic PE information: section name: .didata
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp.0.drStatic PE information: section name: .didata
                              Source: saBSI.exe.1.drStatic PE information: section name: .didat
                              Source: avg_antivirus_free_setup.exe.1.drStatic PE information: section name: .didat
                              Source: BitComet.exe.5.drStatic PE information: section name: .detourc
                              Source: BitComet.exe.5.drStatic PE information: section name: .detourd
                              Source: WebView2Loader.dll.5.drStatic PE information: section name: .00cfg
                              Source: WebView2Loader.dll.5.drStatic PE information: section name: .gxfg
                              Source: WebView2Loader.dll.5.drStatic PE information: section name: .retplne
                              Source: WebView2Loader.dll.5.drStatic PE information: section name: .voltbl
                              Source: WebView2Loader.dll.5.drStatic PE information: section name: _RDATA
                              Source: VideoSnapshot.exe.5.drStatic PE information: section name: _TEXT64
                              Source: VideoSnapshot.exe.5.drStatic PE information: section name: _RDATA
                              Source: installer.exe.10.drStatic PE information: section name: _RDATA
                              Source: avg_antivirus_free_online_setup.exe.11.drStatic PE information: section name: .didat
                              Source: icarus_ui.exe.12.drStatic PE information: section name: _RDATA
                              Source: dump_process.exe.12.drStatic PE information: section name: .didat
                              Source: dump_process.exe.12.drStatic PE information: section name: _RDATA
                              Source: bug_report.exe.12.drStatic PE information: section name: _RDATA
                              Source: icarus.exe.12.drStatic PE information: section name: .didat
                              Source: icarus.exe.12.drStatic PE information: section name: _RDATA
                              Source: bug_report.exe.39.drStatic PE information: section name: _RDATA
                              Source: dump_process.exe.39.drStatic PE information: section name: .didat
                              Source: dump_process.exe.39.drStatic PE information: section name: _RDATA
                              Source: icarus.exe.39.drStatic PE information: section name: .didat
                              Source: icarus.exe.39.drStatic PE information: section name: _RDATA
                              Source: icarus_ui.exe.39.drStatic PE information: section name: _RDATA
                              Source: dump_process.exe0.39.drStatic PE information: section name: .didat
                              Source: dump_process.exe0.39.drStatic PE information: section name: _RDATA
                              Source: bug_report.exe0.39.drStatic PE information: section name: _RDATA
                              Source: icarus.exe0.39.drStatic PE information: section name: .didat
                              Source: icarus.exe0.39.drStatic PE information: section name: _RDATA
                              Source: icarus_product.dll.39.drStatic PE information: section name: _RDATA
                              Source: icarus_product.dll0.39.drStatic PE information: section name: _RDATA
                              Source: installer.exe.40.drStatic PE information: section name: .didat
                              Source: installer.exe.40.drStatic PE information: section name: _RDATA
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeCode function: 8_2_0040ABF1 push ecx; ret 8_2_0040AC04
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_00698DDB push ecx; ret 10_2_00698DEE
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_006C7CFD push ecx; ret 10_2_006C7D12
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 11_2_000B1396 push ecx; ret 11_2_000B13A9
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D6D178 push ecx; ret 12_2_00D6D18B
                              Source: BitCometService.exe.5.drStatic PE information: section name: .text entropy: 6.931897898159348
                              Source: BitCometService.exe0.5.drStatic PE information: section name: .text entropy: 6.931897898159348
                              Source: VideoSnapshot.exe.5.drStatic PE information: section name: .text entropy: 6.902269600709831

                              Persistence and Installation Behavior

                              barindex
                              Contains functionality to infect the boot sector
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: GetVersion,CreateFileW,GetLastError,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive%u11_2_000AA100
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: GetVersion,CreateFileW,GetLastError,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive%u12_2_00D640A0
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: CreateFileW,GetLastError,DeviceIoControl,GetLastError,DeviceIoControl,GetLastError,_strncpy,CloseHandle, \\.\PhysicalDrive%u12_2_00D64380
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: CreateFileW,GetLastError,DeviceIoControl,GetLastError,DeviceIoControl,GetLastError,_strncpy,CloseHandle, \\.\PhysicalDrive%u12_2_00D646E0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeFile created: C:\Program Files\BitComet\tools\Updater.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeFile created: C:\Program Files\BitComet\tools\BitCometToastsNotifier.exeJump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av-vps\icarus.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpFile created: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\is-3V26O.tmpJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpFile created: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\zbShieldUtils.dllJump to dropped file
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\bug_report.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\installer.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeFile created: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\resource.dllJump to dropped file
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeFile created: C:\Program Files\BitComet\tools\BitCometAgent_1.92.7.9.dllJump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\bug_report.exeJump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\icarus_product.dllJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeFile created: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BcNsisHelper.dllJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeFile created: C:\Program Files\BitComet\tools\ChromeLauncher.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpFile created: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeJump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\icarus.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeFile created: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitCometService.exeJump to dropped file
                              Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.OfferCore.5002.4698.exeFile created: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpFile created: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeJump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av-vps\bug_report.exeJump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av-vps\icarus_product.dllJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeFile created: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeJump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\icarus_ui.exeJump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\icarus_rvrt.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpFile created: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe (copy)Jump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeFile created: C:\Program Files\BitComet\tools\VideoSnapshot.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeFile created: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeJump to dropped file
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus_ui.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeFile created: C:\Program Files\BitComet\uninst.exeJump to dropped file
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus_mod.dllJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpFile created: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\_isetup\_setup64.tmpJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeFile created: C:\Program Files\BitComet\BitComet.exeJump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\aswOfferTool.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeFile created: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BcNsisHelperXP.dllJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeFile created: C:\Program Files\BitComet\WebView2Loader.dllJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeFile created: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\System.dllJump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\dump_process.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeFile created: C:\Program Files\BitComet\tools\UPNP.exeJump to dropped file
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\dump_process.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeFile created: C:\Program Files\BitComet\tools\BitCometService.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeFile created: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\http_Downloader.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeFile created: C:\Program Files\BitComet\CrashReport.exeJump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av-vps\icarus_rvrt.exeJump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av-vps\dump_process.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeFile created: C:\Program Files\BitComet\tools\BitCometBHO_1.5.4.11.dllJump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av-vps\icarus.exeJump to dropped file
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus_ui.exeJump to dropped file
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\bug_report.exeJump to dropped file
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus_mod.dllJump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\aswOfferTool.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeFile created: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeJump to dropped file
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeJump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\dump_process.exeJump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\bug_report.exeJump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\icarus_product.dllJump to dropped file
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\dump_process.exeJump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\icarus.exeJump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av-vps\bug_report.exeJump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av-vps\icarus_rvrt.exeJump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av-vps\dump_process.exeJump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av-vps\icarus_product.dllJump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\icarus_ui.exeJump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\icarus_rvrt.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 11_2_000A52F0 InterlockedExchange,GetCurrentProcess,InterlockedExchange,InterlockedExchange,InterlockedExchange,InterlockedExchange,CreateMutexW,GetLastError,InterlockedExchange,InterlockedExchange,InterlockedExchange,InterlockedExchange,InterlockedExchange,InterlockedExchange,CoInitializeEx,CoCreateInstance,CoUninitialize,InterlockedExchange,GetLastError,InterlockedExchange,MessageBoxExW,wsprintfW,wsprintfW,MessageBoxExW,InterlockedExchange,InterlockedExchange,CreateThread,CloseHandle,InterlockedExchange,GetLastError,InterlockedExchange,MoveFileExW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileStringW,GetPrivateProfileIntW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileIntW,GetPrivateProfileStringW,GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileStringW,GetPrivateProfileIntW,wsprintfW,CreateFileW,InterlockedExchange,GetLastError,InterlockedExchange,MoveFileExW,MoveFileExW,GetDiskFreeSpaceExW,InterlockedExchange,InterlockedExchange,MessageBoxExW,InterlockedExchange,GetLastError,InterlockedExchange,wsprintfW,wsprintfW,MessageBoxExW,CloseHandle,CreateFileW,InterlockedExchange,GetLastError,InterlockedExchange,InterlockedExchange,GetLastError,InterlockedExchange,InterlockedExchange,CreateProcessW,InterlockedExchange,GetLastError,InterlockedExchange,AllowSetForegroundWindow,ResumeThread,InterlockedExchange,GetLastError,InterlockedExchange,PostMessageW,WaitForSingleObject,GetExitCodeProcess,InterlockedExchange,InterlockedExchange,InterlockedExchange,CloseHandle,CloseHandle,CloseHandle,_wcsrchr,_wcsrchr,CreateHardLinkW,CopyFileW,ReleaseMutex,CloseHandle,___delayLoadHelper2@8,11_2_000A52F0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeFile created: C:\Program Files\BitComet\ReadMe.txtJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeFile created: C:\Program Files\BitComet\License.txtJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-cs-CZ.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-da-DK.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-de-DE.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-el-GR.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-en-US.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-es-ES.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-es-MX.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-fi-FI.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-fr-CA.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-fr-FR.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-hr-HR.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-hu-HU.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-it-IT.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-ja-JP.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-ko-KR.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-nb-NO.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-nl-NL.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-pl-PL.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-pt-BR.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-pt-PT.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-ru-RU.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-sk-SK.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-sr-Latn-CS.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-sv-SE.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-tr-TR.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-zh-CN.txt
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeFile created: C:\Program Files\McAfee\Temp1561643107\jslang\eula-zh-TW.txt

                              Boot Survival

                              barindex
                              Contains functionality to infect the boot sector
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: GetVersion,CreateFileW,GetLastError,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive%u11_2_000AA100
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: GetVersion,CreateFileW,GetLastError,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive%u12_2_00D640A0
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: CreateFileW,GetLastError,DeviceIoControl,GetLastError,DeviceIoControl,GetLastError,_strncpy,CloseHandle, \\.\PhysicalDrive%u12_2_00D64380
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: CreateFileW,GetLastError,DeviceIoControl,GetLastError,DeviceIoControl,GetLastError,_strncpy,CloseHandle, \\.\PhysicalDrive%u12_2_00D646E0
                              Source: C:\Program Files\BitComet\tools\BitCometService.exeRegistry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BITCOMET_HELPER_SERVICEJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BitComet (64-bit)Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BitComet (64-bit)\BitComet.lnkJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BitComet (64-bit)\HomePage.lnkJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BitComet (64-bit)\Uninstall.lnkJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_00650540 EnterCriticalSection,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LeaveCriticalSection,10_2_00650540
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdateJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
                              Source: C:\Program Files\BitComet\BitComet.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
                              Source: C:\Program Files\BitComet\tools\UPNP.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
                              Source: C:\Program Files\BitComet\tools\UPNP.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
                              Source: C:\Program Files\BitComet\tools\UPNP.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
                              Source: C:\Program Files\BitComet\tools\UPNP.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 BlobJump to behavior
                              Source: C:\Users\user\Desktop\SecuriteInfo.com.Riskware.OfferCore.5002.4698.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files\BitComet\tools\BitCometService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files\BitComet\tools\BitCometService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files\BitComet\tools\BitCometService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files\BitComet\tools\BitCometService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\BitComet.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\tools\BitCometService.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files\BitComet\tools\BitCometService.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX

                              Malware Analysis System Evasion

                              barindex
                              Query firmware table information (likely to detect VMs)
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeSystem information queried: FirmwareTableInformation
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeSystem information queried: FirmwareTableInformation
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeSystem information queried: FirmwareTableInformation
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeSystem information queried: FirmwareTableInformation
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeSystem information queried: FirmwareTableInformation
                              Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2604061607.0000000005C6A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <DEST>%PRODUCT_INST_A64%/ASWHOOK.DLL</DEST>
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2604061607.0000000005C6A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <PATH>%PRODUCT_INST_32%\ASWHOOKX.DLL</PATH>
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2604061607.0000000005C6A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <DEST>%PRODUCT_INST_32%/ASWHOOK.DLL</DEST>
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2604061607.0000000005C6A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <DEST>%PRODUCT_INST_64%/ASWHOOK.DLL</DEST>
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeMemory allocated: 31C0000 memory reserve | memory write watchJump to behavior
                              Source: C:\Program Files\BitComet\tools\BitCometService.exeCode function: 7_2_00401440 rdtsc 7_2_00401440
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_00624C8E GetCurrentProcessId,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,FindCloseChangeNotification,10_2_00624C8E
                              Source: C:\Program Files\BitComet\BitComet.exeWindow / User API: foregroundWindowGot 449
                              Source: C:\Program Files\BitComet\tools\BitCometService.exeWindow / User API: threadDelayed 2860
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeDropped PE file which has not been started: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av-vps\icarus.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDropped PE file which has not been started: C:\Program Files\BitComet\tools\BitCometToastsNotifier.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDropped PE file which has not been started: C:\Program Files\BitComet\tools\Updater.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\zbShieldUtils.dllJump to dropped file
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeDropped PE file which has not been started: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\bug_report.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDropped PE file which has not been started: C:\Program Files\McAfee\Temp1561643107\installer.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exeDropped PE file which has not been started: C:\Program Files\McAfee\Temp1561643107\resource.dllJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDropped PE file which has not been started: C:\Program Files\BitComet\tools\BitCometAgent_1.92.7.9.dllJump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeDropped PE file which has not been started: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\bug_report.exeJump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeDropped PE file which has not been started: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\icarus_product.dllJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BcNsisHelper.dllJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDropped PE file which has not been started: C:\Program Files\BitComet\tools\ChromeLauncher.exeJump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeDropped PE file which has not been started: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av-vps\bug_report.exeJump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeDropped PE file which has not been started: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av-vps\icarus_product.dllJump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeDropped PE file which has not been started: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\icarus_ui.exeJump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeDropped PE file which has not been started: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\icarus_rvrt.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDropped PE file which has not been started: C:\Program Files\BitComet\tools\VideoSnapshot.exeJump to dropped file
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeDropped PE file which has not been started: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus_ui.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDropped PE file which has not been started: C:\Program Files\BitComet\uninst.exeJump to dropped file
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeDropped PE file which has not been started: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus_mod.dllJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\_isetup\_setup64.tmpJump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeDropped PE file which has not been started: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\aswOfferTool.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BcNsisHelperXP.dllJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\System.dllJump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeDropped PE file which has not been started: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\dump_process.exeJump to dropped file
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeDropped PE file which has not been started: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\dump_process.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\http_Downloader.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDropped PE file which has not been started: C:\Program Files\BitComet\CrashReport.exeJump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeDropped PE file which has not been started: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av-vps\icarus_rvrt.exeJump to dropped file
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeDropped PE file which has not been started: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av-vps\dump_process.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeDropped PE file which has not been started: C:\Program Files\BitComet\tools\BitCometBHO_1.5.4.11.dllJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp TID: 6952Thread sleep time: -30000s >= -30000sJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp TID: 6968Thread sleep time: -90000s >= -30000sJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exe TID: 6384Thread sleep time: -30000s >= -30000sJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exe TID: 6996Thread sleep time: -30000s >= -30000s
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe TID: 3052Thread sleep time: -30000s >= -30000s
                              Source: C:\Program Files\BitComet\tools\BitCometService.exe TID: 4388Thread sleep count: 2860 > 30
                              Source: C:\Windows\System32\svchost.exe TID: 1228Thread sleep time: -30000s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeFile opened: PhysicalDrive0
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809
                              Source: C:\Program Files\BitComet\tools\BitCometService.exeLast function: Thread delayed
                              Source: C:\Program Files\BitComet\tools\BitCometService.exeLast function: Thread delayed
                              Source: C:\Program Files\BitComet\tools\BitCometService.exeThread sleep count: Count: 2860 delay: -10
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpFile Volume queried: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp FullSizeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpFile Volume queried: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp FullSizeInformationJump to behavior
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeFile Volume queried: C:\ FullSizeInformation
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeFile Volume queried: C:\ FullSizeInformation
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeFile Volume queried: C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Code Cache\wasm FullSizeInformation
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeFile Volume queried: C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Code Cache\js FullSizeInformation
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeFile Volume queried: C:\Users\user\AppData\Local\BitComet\EBWebView\Default\blob_storage\6b9348ea-9fc1-4c1f-a7d2-490662dd4467 FullSizeInformation
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeFile Volume queried: C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Cache\Cache_Data FullSizeInformation
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile Volume queried: C:\ FullSizeInformation
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeFile Volume queried: C:\ FullSizeInformation
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeCode function: 5_2_0040672B FindFirstFileW,FindClose,5_2_0040672B
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeCode function: 5_2_00405AFA CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,5_2_00405AFA
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeCode function: 5_2_00402868 FindFirstFileW,5_2_00402868
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D0C5F0 FindFirstFileExW,GetLastError,PathMatchSpecW,FindNextFileW,GetLastError,FindClose,12_2_00D0C5F0
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D0A030 FindFirstFileW,FindNextFileW,FindClose,GetFileAttributesW,GetFileAttributesW,SetFileAttributesW,RemoveDirectoryW,Sleep,GetFileAttributesW,12_2_00D0A030
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D34F20 FindFirstFileW,MoveFileExW,GetLastError,FindNextFileW,GetFileAttributesW,GetLastError,MoveFileExW,GetLastError,FindClose,12_2_00D34F20
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_00682782 VirtualQuery,GetSystemInfo,10_2_00682782
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpFile opened: C:\Users\userJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpFile opened: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmpJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpFile opened: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extractJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpFile opened: C:\Users\user\AppDataJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpFile opened: C:\Users\user\AppData\Local\TempJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpFile opened: C:\Users\user\AppData\LocalJump to behavior
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2394853669.0000000003538000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:U
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760509842.000000000085F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2633853589.0000000004EA0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware, Inc.
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.000000000085C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "ctu":"https://home.mcafee.com/Root/AboutUs.aspx?id=eula","pv":"1.26","ov":63,"ud":true,"v":4}},{"ad":{"n":"","f":"ZB_TotalSecurity_V4","o":"TotalSecurity_AV"},"ps":{"i":"TotalSecurity_AV/images/1127/V4/EN.png","dn":"360 Total Security","u":"TotalSecurity_AV/files/1127/ts360Setup.zip","p":"/s","r":["Microsoft\\Windows\\CurrentVersion\\Uninstall\\360TotalSecurity","360TotalSecurity","360Safe","VMware, Inc."],"cp":"https://www.360,
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.00000000007D7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000815000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000003.2227227262.000000000071F000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000003.2228162848.0000000000701000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000003.2227044278.0000000000700000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000002.2230382325.0000000000701000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000002.2897708570.0000000002EB9000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2895072615.0000000002EB9000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002EBA000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2373312406.0000000002EBA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000815000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWe6
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2405758044.000000000355C000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2631626247.0000000003555000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2611110279.0000000003549000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2447801969.000000000355C000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2417641679.0000000003559000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2403430429.0000000003559000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000002.2976217934.0000000003544000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2571577024.000000000355B000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2536687235.000000000355A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWen-GBn
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2618744694.000000000087E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware, Inc.0
                              Source: BitComet_stats.exe, 00000008.00000003.2228249240.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000002.2230315967.00000000006E3000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000003.2227384369.00000000006E3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWp{p%SystemRoot%\system32\mswsock.dll
                              Source: saBSI.exe, 0000000A.00000002.2897708570.0000000002EB9000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2895072615.0000000002EB9000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002EBA000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2373312406.0000000002EBA000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002EB9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%r
                              Source: saBSI.exe, 0000000A.00000002.2897708570.0000000002E76000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2895072615.0000000002E73000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW`
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1778301135.0000000000861000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Windows\\CurrentVersion\\Uninstall\\ReasonLabs-EPP","VMware, Inc."],"rvd":["HKLM
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2392210299.0000000003537000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
                              Source: BitComet_2.08a_setup.exe, 00000005.00000002.2247774329.000000000080F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
                              Source: BitComet.exe, 0000000D.00000002.2420857876.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmp, BitComet.exe, 0000000D.00000000.2403166450.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmpBinary or memory string: /\..\\?\UNC\/\\\?\:*:.*.*NULCOM7COM6COM9COM8COM3COM2COM5COM4AUXPRNCOM1NULCON.cmd.pif.bat.scf .LPT9.scr.comLPT6LPT5LPT8LPT7LPT2LPT1LPT4LPT3.webm.mov.ogv.ogm.mpeg.mpg.mpv.m4v.avi.rm.asf.wmv.xpi.vbs.rmvb.apk.ps.m2ts.mod.ts.scm.f4v.hlv.ifo.3g2.3gpp.pmp.3gp2.qt.divx.3gp.vob.mp2.flac.wv.mpa.mpga.ape.vqf.amr.aac.au.wma.ogg.mp3.mid.ram.ra.svgz.svg.tif.tiff.pct.pict.psd.pic.jp2.jpg2.pcx.pcd.dff.dsf.emf.epsntfs.nrghgfsapfs.ccd.iso.mds.cue.gz.7z.rar.bz2.wmf.tga.xpm.xbmhfsfuse-rcloneext2exfatrefsext3
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2627572791.0000000003622000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: ln:opera_new_a","c":"opera_new_a","a":["OperaSetup","OperaSetup.exe","OperaGXSetup.exe","OperaGXSetup"],"r":["Opera Software"],"cp":"https://www.opera.com/he/privacy","ctu":"https://www.opera.com/he/eula/computers","ov":100,"cbfo":true,"pv":"1.23","v":3,"x":3}},{"ad":{"n":"","f":"ZB_WZ_V1","o":"WeatherZero"},"ps":{"i":"WeatherZero/images/969/EN.png","dn":"WeatherZero","u":"WeatherZero/files/969/WZSetup.zip","p":"/S /tpchannelid=1571 /distid=App123","r":["Microsoft\\Windows\\CurrentVersion\\Uninstall\\WeatherZero"],"cp":"https://www.premieropinion.com/privacy-policy","ctu":"https://www.premieropinion.com/common/termsofservice-v1","pv":"1.26","cbfo":true,"v":4}},{"ad":{"n":"","f":"ZB_AVG_TuneUp","o":"AVG_TuneUp"},"ps":{"dn":"AVG TuneUp","i":"AVG_TuneUp/images/1543/EN.png","u":"AVG_TuneUp/files/1543/Fixed_Build/avg_tuneup_online_setup.zip","p":"/silent /delayUIStart:120","r":["Microsoft\\Windows\\CurrentVersion\\Uninstall\\CCleaner","Microsoft\\Windows\\CurrentVersion\\Uninstall\\Avast Cleanup","Microsoft\\Windows\\CurrentVersion\\Uninstall\\AVG TuneUp","Microsoft\\Windows\\CurrentVersion\\Uninstall\\Avira Security_is1","Microsoft\\Windows\\CurrentVersion\\Uninstall\\Norton Utilities"],"cp":"https://www.avast.com/privacy-policy#pc","ctu":"https://www.avast.com/eula#pc","ov":61,"ram":1000,"disk":2000,"pv":"1.32","v":5}},{"ad":{"n":9,"nn":"Med_Ntiles","f":"ZB_Avast","o":"AVAST"},"ps":{"i":"AVAST/images/DOTPS-1511/547X280/EN.png","dn":"Avast Antivirus","u":"AVAST/files/cookie_mmm_irs_ppi_005_888_a.zip","p":"/silent /ws /psh:{pxl}","rvd":["HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment\\PROCESSOR_ARCHITECTURE\\ARM64"],"r":["AVAST Software\\Avast","Microsoft\\Windows\\CurrentVersion\\Uninstall\\Avast","Microsoft\\Windows\\CurrentVersion\\Uninstall\\Avast Antivirus","Microsoft\\Windows\\CurrentVersion\\Uninstall\\AVG Antivirus","Microsoft\\Windows\\CurrentVersion\\Uninstall\\{4CB91122-AA85-4431-953C-BEFAEC86DA97}_is1","WebBar","WebDiscoverBrowser","AVG\\Antivirus\\Version","AVG\\AV\\Dir"],"a":["AvastSvc","instup","AvastUI","AVGUI","avguix","AVGSvc","avgsvca"],"ctu":"https://www.avast.com/eula-avast-consumer-products","cp":"https://www.avast.com/privacy-policy","ov":61,"cbfo":true,"avauc":true,"avur":"AvUninstallTimestamp","pv":"1.29","x":12,"disk":2560,"ram":256,"iapp":["chrome.exe"],"v":1}},{"ad":{"n":"","f":"ZB_MSSP","o":"MSSP"},"ps":{"i":"MSSP/images/lightBG/EN.png","dn":"MSSP","u":"MSSP/files/DOTPS-595/securityscan_release_small.zip","p":"/silent","r":["Microsoft\\Windows\\CurrentVersion\\Uninstall\\{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}","McAfee\\SiteAdvisor","McAfee\\WebAdvisor","Microsoft\\Windows\\CurrentVersion\\Uninstall\\McAfee Security Scan"],"rvd":["HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment\\PROCESSOR_ARCHITECTURE\\ARM64"],"cp":"https://www.mcafee.com/consumer/en-us/policy/global/legal.html","ctu":"https://home.mcafee.com/Root/AboutUs.aspx?id=eula","pv":"1.26","ov":63,"ud":true,"v":4}},{"ad
                              Source: BitComet.exe, 0000000D.00000002.2417931691.0000023E813D6000.00000004.00000020.00020000.00000000.sdmp, BitComet.exe, 0000000D.00000003.2413761678.0000023E813C7000.00000004.00000020.00020000.00000000.sdmp, BitComet.exe, 0000000D.00000003.2413848761.0000023E813D3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll1
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2390793491.000000000350E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Volume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:++<
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000828000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: S":"ZB_Avast","o":"AVAST"},"ps":{"i":"AVAST/images/DOTPS-1511/547X280/EN.png","dn":"Avast Antivirus","u":"AVAST/files/cookie_mmm_irs_ppi_005_888_a.zip","p":"/silent /ws /psh:{pxl}","rvd":["HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment\\PROCESSOR_ARCHITECTURE\\ARM64"],"r":["AVAST Software\\Avast","Microsoft\\Windows\\CurrentVersion\\Uninstall\\Avast","Microsoft\\Windows\\CurrentVersion\\Uninstall\\Avast Antivirus","Microsoft\\Windows\\CurrentVersion\\Uninstall\\AVG Antivirus","Microsoft\\Windows\\CurrentVersion\\Uninstall\\{4CB91122-AA85-4431-953C-BEFAEC86DA97}_is1","WebBar","WebDiscoverBrowser","AVG\\Antivirus\\Version","AVG\\AV\\Dir"],"a":["AvastSvc","instup","AvastUI","AVGUI","avguix","AVGSvc","avgsvca"],"ctu":"https://www.avast.com/eula-avast-consumer-products","cp":"https://www.avast.com/privacy-policy","ov":61,"cbfo":true,"avauc":true,"avur":"AvUninstallTimestamp","pv":"1.29","x":12,"disk":2560,"ram":256,"iapp":["chrome.exe"],"v":1}},{"ad":{"n":"","f":"ZB_MSSP","o":"MSSP"},"ps":{"i":"MSSP/images/lightBG/EN.png","dn":"MSSP","u":"MSSP/files/DOTPS-595/securityscan_release_small.zip","p":"/silent","r":["Microsoft\\Windows\\CurrentVersion\\Uninstall\\{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}","McAfee\\SiteAdvisor","McAfee\\WebAdvisor","Microsoft\\Windows\\CurrentVersion\\Uninstall\\McAfee Security Scan"],"rvd":["HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment\\PROCESSOR_ARCHITECTURE\\ARM64"],"cp":"https://www.mcafee.com/consumer/en-us/policy/global/legal.html","ctu":"https://home.mcafee.com/Root/AboutUs.aspx?id=eula","pv":"1.26","ov":63,"ud":true,"v":4}},{"ad":{"n":"","f":"ZB_TotalSecurity_V4","o":"TotalSecurity_AV"},"ps":{"i":"TotalSecurity_AV/images/1127/V4/EN.png","dn":"360 Total Security","u":"TotalSecurity_AV/files/1127/ts360Setup.zip","p":"/s","r":["Microsoft\\Windows\\CurrentVersion\\Uninstall\\360TotalSecurity","360TotalSecurity","360Safe","VMware, Inc."],"cp":"https://www.360
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2391715848.0000000003536000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:$
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2363617302.0000000004EF6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-0L
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000002.2976217934.0000000003565000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: /icarus-info-path:C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\icarus-info.xml /install /silent /ws /psh:92pTu5fbOaMVqHXWzRazGwcsjZOgyQNZV0BXrS1y4TWZ27PXSitlzA5vE30PraTCAoRM4emN7pEfhI /cookie:mmm_irs_ppi_902_451_o /edat_dir:C:\Windows\Temp\asw.481015ae89dc80a3 /track-guid:1840c678-d62a-4945-8e4f-36eaf3f0c4a5e33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1778301135.000000000085C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "ctu":"https://home.mcafee.com/Root/AboutUs.aspx?id=eula","pv":"1.26","ov":63,"ud":true,"v":4}},{"ad":{"n":"","f":"ZB_TotalSecurity_V4","o":"TotalSecurity_AV"},"ps":{"i":"TotalSecurity_AV/images/1127/V4/EN.png","dn":"360 Total Security","u":"TotalSecurity_AV/files/1127/ts360Setup.zip","p":"/s","r":["Microsoft\\Windows\\CurrentVersion\\Uninstall\\360TotalSecurity","360TotalSecurity","360Safe","VMware, Inc."],"cp":"https://www.360
                              Source: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.000000000087D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "Microsoft\\Windows\\CurrentVersion\\Uninstall\\360TotalSecurity","360TotalSecurity","360Safe","VMware, Inc."],"cp":"https://www.360totalsecurity.com/en/privacy/","ctu":"https://www.360totalsecurity.com/en/license/","pv":"1.26","cbfo":true,"v":1}},{"ad":{"n":"","f":"ZB_Opera_re_V3","o":"Opera_reengaged"},"ps":{"i":"Opera/images/DOTPS-483/EN.png","dn":"Opera","u":"Opera/files/AutoReplaced/OperaSetup.zip","p":"--silent --allusers=0 --otd=utm.medium:pb,utm.source:ais,utm.campaign:opera_reengaged","c":"opera_reengaged","a":["OperaSetup","OperaSetup.exe","OperaGXSetup.exe","OperaGXSetup"],"ir":["Opera Software"],"rp":["Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\^Opera"],"cp":"https://www.opera.com/he/privacy","ctu":"https://www.opera.com/he/eula/computers","ov":100,"cbfo":true,"pv":"1.34","v":3,"x":3}},{"ad":{"n":"","f":"ZB_BuddiesUno_V2","o":"BuddiesUno"},"ps":{"dn":"Buddies Uno","i":"BuddiesUno/images/1514/V2/EN.png","u":"BuddiesUno/files/1561-aflt/UnoBuddies.zip","p":"/S /delaylaunch=3 /aflt={pubid}","rvn":["HKEY_CURRENT_USER\\SOFTWARE\\Uno Buddies\\Main\\UserID"],"cp":"https://buddies.uno/Software/PrivacyPolicy/PrivayPolicy.html","ctu":"https://buddies.uno/Software/Eula/eula.html","ov":100,"pv":"1.32","v":7}}],"c":""}
                              Source: avg_antivirus_free_online_setup.exe, 0000000C.00000003.2390869438.000000000351D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:%%
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeAPI call chain: ExitProcess graph end nodegraph_5-3736
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess information queried: ProcessInformationJump to behavior

                              Anti Debugging

                              barindex
                              Potentially malicious time measurement code found
                              Source: C:\Program Files\BitComet\tools\BitCometService.exeCode function: 7_2_004014407_2_00401440
                              Source: C:\Program Files\BitComet\tools\BitCometService.exeCode function: 7_2_004013D07_2_004013D0
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess queried: DebugPortJump to behavior
                              Source: C:\Program Files\BitComet\tools\BitCometService.exeCode function: 7_2_00401440 rdtsc 7_2_00401440
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeCode function: 8_2_0040D1EB _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,8_2_0040D1EB
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_00635204 RegOpenKeyExW,RegQueryValueExW,SetLastError,RegCloseKey,RegCloseKey,GetLastError,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,LoadLibraryExW,GetLastError,10_2_00635204
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_00624C8E GetCurrentProcessId,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,FindCloseChangeNotification,10_2_00624C8E
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_006C7BC0 VirtualProtect ?,-00000001,00000104,?,?,?,0000001C10_2_006C7BC0
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeCode function: 8_2_0040A15D IsProcessorFeaturePresent,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcessHeap,GetProcessHeap,HeapAlloc,InterlockedCompareExchange,GetProcessHeap,HeapFree,8_2_0040A15D
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_006AE8FE mov eax, dword ptr fs:[00000030h]10_2_006AE8FE
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_006B7C6A mov eax, dword ptr fs:[00000030h]10_2_006B7C6A
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_006B7CF2 mov eax, dword ptr fs:[00000030h]10_2_006B7CF2
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_006B7CAE mov eax, dword ptr fs:[00000030h]10_2_006B7CAE
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_006B7D23 mov eax, dword ptr fs:[00000030h]10_2_006B7D23
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 11_2_000B7C5A mov eax, dword ptr fs:[00000030h]11_2_000B7C5A
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00DABE06 mov eax, dword ptr fs:[00000030h]12_2_00DABE06
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00DA4A68 mov ecx, dword ptr fs:[00000030h]12_2_00DA4A68
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00DABE4A mov eax, dword ptr fs:[00000030h]12_2_00DABE4A
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeCode function: 8_2_0040A2BF GetProcessHeap,HeapAlloc,RtlInterlockedPopEntrySList,VirtualAlloc,RtlInterlockedPopEntrySList,VirtualFree,RtlInterlockedPushEntrySList,8_2_0040A2BF
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeProcess token adjusted: Debug
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeCode function: 8_2_0040D1EB _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,8_2_0040D1EB
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeCode function: 8_2_0040AB6A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,8_2_0040AB6A
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_00699018 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,10_2_00699018
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_006993F2 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,10_2_006993F2
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_0069D453 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,10_2_0069D453
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: 10_2_00699586 SetUnhandledExceptionFilter,10_2_00699586
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 11_2_000B10FF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,11_2_000B10FF
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 11_2_000B1292 SetUnhandledExceptionFilter,11_2_000B1292
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 11_2_000B13AB SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,11_2_000B13AB
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeCode function: 11_2_000B4476 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,11_2_000B4476
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D6C8F1 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,12_2_00D6C8F1
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D929F3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,12_2_00D929F3
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00D6D3B0 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,12_2_00D6D3B0
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exe "C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exe" /affid 91088 PaidDistribution=true CountryCode=USJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpProcess created: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exe "C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exe" /silent /ws /psh:92pTu5fbOaMVqHXWzRazGwcsjZOgyQNZV0BXrS1y4TWZ27PXSitlzA5vE30PraTCAoRM4emN7pEfhIJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeProcess created: C:\Program Files\BitComet\tools\BitCometService.exe "C:\Program Files\BitComet\tools\BitCometService.exe" /regJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeProcess created: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe "C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe" /silent /ws /psh:92pTu5fbOaMVqHXWzRazGwcsjZOgyQNZV0BXrS1y4TWZ27PXSitlzA5vE30PraTCAoRM4emN7pEfhI /cookie:mmm_irs_ppi_902_451_o /ga_clientid:1840c678-d62a-4945-8e4f-36eaf3f0c4a5 /edat_dir:C:\Windows\Temp\asw.481015ae89dc80a3
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeProcess created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\icarus-info.xml /install /silent /ws /psh:92pTu5fbOaMVqHXWzRazGwcsjZOgyQNZV0BXrS1y4TWZ27PXSitlzA5vE30PraTCAoRM4emN7pEfhI /cookie:mmm_irs_ppi_902_451_o /edat_dir:C:\Windows\Temp\asw.481015ae89dc80a3 /track-guid:1840c678-d62a-4945-8e4f-36eaf3f0c4a5
                              Source: C:\Program Files\BitComet\BitComet.exeProcess created: C:\Program Files\BitComet\tools\UPNP.exe "C:\Program Files\BitComet\tools\UPNP.exe" -addfw -app BitComet -tcpport 9652 -udpport 9652 -q
                              Source: C:\Program Files\BitComet\BitComet.exeProcess created: C:\Program Files\BitComet\tools\UPNP.exe "C:\Program Files\BitComet\tools\UPNP.exe" -add -app BitComet -lanip 192.168.2.4 -tcpport 9652 -udpport 9652 -q
                              Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 6740 -ip 6740
                              Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6740 -s 968
                              Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 6740 -ip 6740
                              Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6740 -s 968
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Local\BitComet\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Local\BitComet\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x15c,0x160,0x164,0x138,0x170,0x7ffdfab78e88,0x7ffdfab78e98,0x7ffdfab78ea8
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2484 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:2
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2924 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:3
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2920 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:8
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6693313984 --mojo-platform-channel-handle=3272 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:1
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6693485965 --mojo-platform-channel-handle=3588 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:1
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6693635288 --mojo-platform-channel-handle=3776 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:1
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6693754114 --mojo-platform-channel-handle=4048 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:1
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --disable-gpu-compositing --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6697808392 --mojo-platform-channel-handle=4692 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:1
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --disable-gpu-compositing --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6698303265 --mojo-platform-channel-handle=4760 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:1
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeProcess created: unknown unknown
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeProcess created: unknown unknown
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeProcess created: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe "c:\windows\temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe" /silent /ws /psh:92ptu5fboamvqhxwzrazgwcsjzogyqnzv0bxrs1y4twz27pxsitlza5ve30pratcaorm4emn7pefhi /cookie:mmm_irs_ppi_902_451_o /ga_clientid:1840c678-d62a-4945-8e4f-36eaf3f0c4a5 /edat_dir:c:\windows\temp\asw.481015ae89dc80a3
                              Source: C:\Program Files\BitComet\BitComet.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=bitcomet.exe --webview-exe-version=2.08 --user-data-dir="c:\users\user\appdata\local\bitcomet\ebwebview" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --enable-features=mojoipcz --mojo-named-platform-channel-pipe=6032.3612.7348265561393428437
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=c:\users\user\appdata\local\bitcomet\ebwebview /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=c:\users\user\appdata\local\bitcomet\ebwebview\crashpad --annotation=isofficialbuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=win64 "--annotation=prod=edge webview2" --annotation=ver=117.0.2045.47 --initial-client-data=0x15c,0x160,0x164,0x138,0x170,0x7ffdfab78e88,0x7ffdfab78e98,0x7ffdfab78ea8
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="c:\users\user\appdata\local\bitcomet\ebwebview" --webview-exe-name=bitcomet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --mojo-platform-channel-handle=2484 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=mojoipcz /prefetch:2
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --noerrdialogs --user-data-dir="c:\users\user\appdata\local\bitcomet\ebwebview" --webview-exe-name=bitcomet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2924 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=mojoipcz /prefetch:3
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.storageservice --lang=en-gb --service-sandbox-type=service --noerrdialogs --user-data-dir="c:\users\user\appdata\local\bitcomet\ebwebview" --webview-exe-name=bitcomet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2920 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=mojoipcz /prefetch:8
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="c:\users\user\appdata\local\bitcomet\ebwebview" --webview-exe-name=bitcomet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --first-renderer-process --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_ch" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6693313984 --mojo-platform-channel-handle=3272 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=mojoipcz /prefetch:1
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="c:\users\user\appdata\local\bitcomet\ebwebview" --webview-exe-name=bitcomet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_ch" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6693485965 --mojo-platform-channel-handle=3588 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=mojoipcz /prefetch:1
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="c:\users\user\appdata\local\bitcomet\ebwebview" --webview-exe-name=bitcomet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_ch" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6693635288 --mojo-platform-channel-handle=3776 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=mojoipcz /prefetch:1
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="c:\users\user\appdata\local\bitcomet\ebwebview" --webview-exe-name=bitcomet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_ch" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6693754114 --mojo-platform-channel-handle=4048 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=mojoipcz /prefetch:1
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="c:\users\user\appdata\local\bitcomet\ebwebview" --webview-exe-name=bitcomet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --disable-gpu-compositing --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_ch" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6697808392 --mojo-platform-channel-handle=4692 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=mojoipcz /prefetch:1
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="c:\users\user\appdata\local\bitcomet\ebwebview" --webview-exe-name=bitcomet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --disable-gpu-compositing --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_ch" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6698303265 --mojo-platform-channel-handle=4760 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=mojoipcz /prefetch:1
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeProcess created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe c:\windows\temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe /icarus-info-path:c:\windows\temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\icarus-info.xml /install /silent /ws /psh:92ptu5fboamvqhxwzrazgwcsjzogyqnzv0bxrs1y4twz27pxsitlza5ve30pratcaorm4emn7pefhi /cookie:mmm_irs_ppi_902_451_o /edat_dir:c:\windows\temp\asw.481015ae89dc80a3 /track-guid:1840c678-d62a-4945-8e4f-36eaf3f0c4a5
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exeProcess created: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe "c:\windows\temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe" /silent /ws /psh:92ptu5fboamvqhxwzrazgwcsjzogyqnzv0bxrs1y4twz27pxsitlza5ve30pratcaorm4emn7pefhi /cookie:mmm_irs_ppi_902_451_o /ga_clientid:1840c678-d62a-4945-8e4f-36eaf3f0c4a5 /edat_dir:c:\windows\temp\asw.481015ae89dc80a3
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeProcess created: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe c:\windows\temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe /icarus-info-path:c:\windows\temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\icarus-info.xml /install /silent /ws /psh:92ptu5fboamvqhxwzrazgwcsjzogyqnzv0bxrs1y4twz27pxsitlza5ve30pratcaorm4emn7pefhi /cookie:mmm_irs_ppi_902_451_o /edat_dir:c:\windows\temp\asw.481015ae89dc80a3 /track-guid:1840c678-d62a-4945-8e4f-36eaf3f0c4a5
                              Source: C:\Program Files\BitComet\BitComet.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=bitcomet.exe --webview-exe-version=2.08 --user-data-dir="c:\users\user\appdata\local\bitcomet\ebwebview" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --enable-features=mojoipcz --mojo-named-platform-channel-pipe=6032.3612.7348265561393428437
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=c:\users\user\appdata\local\bitcomet\ebwebview /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=c:\users\user\appdata\local\bitcomet\ebwebview\crashpad --annotation=isofficialbuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=win64 "--annotation=prod=edge webview2" --annotation=ver=117.0.2045.47 --initial-client-data=0x15c,0x160,0x164,0x138,0x170,0x7ffdfab78e88,0x7ffdfab78e98,0x7ffdfab78ea8
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="c:\users\user\appdata\local\bitcomet\ebwebview" --webview-exe-name=bitcomet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --mojo-platform-channel-handle=2484 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=mojoipcz /prefetch:2
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --noerrdialogs --user-data-dir="c:\users\user\appdata\local\bitcomet\ebwebview" --webview-exe-name=bitcomet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2924 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=mojoipcz /prefetch:3
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.storageservice --lang=en-gb --service-sandbox-type=service --noerrdialogs --user-data-dir="c:\users\user\appdata\local\bitcomet\ebwebview" --webview-exe-name=bitcomet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2920 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=mojoipcz /prefetch:8
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="c:\users\user\appdata\local\bitcomet\ebwebview" --webview-exe-name=bitcomet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --first-renderer-process --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_ch" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6693313984 --mojo-platform-channel-handle=3272 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=mojoipcz /prefetch:1
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="c:\users\user\appdata\local\bitcomet\ebwebview" --webview-exe-name=bitcomet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_ch" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6693485965 --mojo-platform-channel-handle=3588 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=mojoipcz /prefetch:1
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="c:\users\user\appdata\local\bitcomet\ebwebview" --webview-exe-name=bitcomet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_ch" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6693635288 --mojo-platform-channel-handle=3776 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=mojoipcz /prefetch:1
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="c:\users\user\appdata\local\bitcomet\ebwebview" --webview-exe-name=bitcomet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_ch" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6693754114 --mojo-platform-channel-handle=4048 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=mojoipcz /prefetch:1
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="c:\users\user\appdata\local\bitcomet\ebwebview" --webview-exe-name=bitcomet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --disable-gpu-compositing --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_ch" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6697808392 --mojo-platform-channel-handle=4692 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=mojoipcz /prefetch:1
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeProcess created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="c:\users\user\appdata\local\bitcomet\ebwebview" --webview-exe-name=bitcomet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --disable-gpu-compositing --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_ch" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6698303265 --mojo-platform-channel-handle=4760 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=mojoipcz /prefetch:1
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: 12_2_00CEFD70 AllocateAndInitializeSid,GetLengthSid,LocalAlloc,CopySid,LocalAlloc,InitializeAcl,AddAce,TreeResetNamedSecurityInfoW,SetLastError,12_2_00CEFD70
                              Source: BitComet.exe, 0000000D.00000002.2420857876.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmp, BitComet.exe, 0000000D.00000000.2403166450.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmpBinary or memory string: RunningTasksThumbnailTipHelper::ShowThumbnailAtCursorIfTaskbarCreatedTrayIconTrayClockWClassShell_TrayWndCtrlSettings: handle saved for remove invalid system tray icon aftrer crashsystray_hidesystray_animatmpTrayNotifyWnd
                              Source: C:\Program Files\BitComet\tools\BitCometService.exeCode function: 7_2_00401000 cpuid 7_2_00401000
                              Source: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exeCode function: GetThreadLocale,GetLocaleInfoA,GetACP,8_2_0040A06A
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: GetLocaleInfoW,10_2_006B45DA
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: EnumSystemLocalesW,10_2_006BC952
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: EnumSystemLocalesW,10_2_006BC907
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: EnumSystemLocalesW,10_2_006BC9ED
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,10_2_006BCA80
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: GetLocaleInfoW,10_2_006BCCE0
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,10_2_006BCE06
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: GetLocaleInfoW,10_2_006BCF0C
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,10_2_006BCFDB
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: GetLocaleInfoEx,10_2_00697E28
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeCode function: EnumSystemLocalesW,10_2_006B3F6D
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: GetACP,IsValidCodePage,GetLocaleInfoW,12_2_00DB499F
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: GetLocaleInfoW,12_2_00DB4BA0
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: EnumSystemLocalesW,12_2_00DB4C92
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: EnumSystemLocalesW,12_2_00DB4C47
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,12_2_00DB4DC0
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: EnumSystemLocalesW,12_2_00DB4D2D
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: GetLocaleInfoW,12_2_00DB5020
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,12_2_00DB5149
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: GetLocaleInfoW,12_2_00DB524F
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,12_2_00DB531E
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: EnumSystemLocalesW,12_2_00DAB5CD
                              Source: C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exeCode function: GetLocaleInfoW,12_2_00DABB33
                              Source: C:\Program Files\BitComet\BitComet.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
                              Source: C:\Program Files\BitComet\BitComet.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\logo.png VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\AVG_AV.png VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0.zip VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0.zip VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0.zip VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0.zip VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0.zip VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1.zip VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1.zip VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1.zip VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1.zip VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1.zip VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\finish.png VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeQueries volume information: C:\ VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeQueries volume information: C:\ VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeQueries volume information: C:\ VolumeInformationJump to behavior
                              Source: C:\Program Files\BitComet\BitComet.exeQueries volume information: C:\ VolumeInformation
                              Source: C:\Program Files\BitComet\BitComet.exeQueries volume information: C:\ VolumeInformation
                              Source: C:\Program Files\BitComet\BitComet.exeQueries volume information: C:\ VolumeInformation
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeQueries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeQueries volume information: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\WidevineCdm\manifest.json VolumeInformation
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeQueries volume information: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\Trust Protection Lists\manifest.json VolumeInformation
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeQueries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeQueries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeQueries volume information: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\MEIPreload\preloaded_data.pb VolumeInformation
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
                              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
                              Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exeQueries volume information: C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Network\SCT Auditing Pending Reports VolumeInformation
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
                              Source: C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
                              Source: C:\Program Files\BitComet\tools\BitCometService.exeCode function: 7_2_00488585 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,7_2_00488585
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exeCode function: 5_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,5_2_004034A5
                              Source: C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmpKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
                              Source: BitComet.exe, 0000000D.00000003.2414040675.0000023E813B7000.00000004.00000020.00020000.00000000.sdmp, BitComet.exe, 0000000D.00000003.2413916853.0000023E813AC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: RavLite.exe
                              Source: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exeRegistry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 BlobJump to behavior
                              Source: C:\Program Files\BitComet\BitComet.exeRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION

                              Stealing of Sensitive Information

                              barindex
                              Yara detected PrivateLoader
                              Source: Yara matchFile source: 7.0.BitCometService.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 7.2.BitCometService.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 15.2.BitCometService.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 15.0.BitCometService.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 5.2.BitComet_2.08a_setup.exe.2795664.2.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 5.2.BitComet_2.08a_setup.exe.2a24690.3.raw.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 5.2.BitComet_2.08a_setup.exe.2795664.2.raw.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 00000007.00000000.2218766402.0000000000401000.00000020.00000001.01000000.00000011.sdmp, type: MEMORY
                              Source: Yara matchFile source: 0000000F.00000000.2414944136.0000000000401000.00000020.00000001.01000000.00000011.sdmp, type: MEMORY
                              Source: Yara matchFile source: 0000000F.00000002.2966448744.0000000000401000.00000020.00000001.01000000.00000011.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000007.00000002.2219985855.0000000000401000.00000020.00000001.01000000.00000011.sdmp, type: MEMORY
                              Source: Yara matchFile source: C:\Program Files\BitComet\tools\BitCometService.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files\BitComet\tools\VideoSnapshot.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\nsrA1A4.tmp, type: DROPPED
                              Yara detected QueryWinSAT ClassID
                              Source: Yara matchFile source: 00000001.00000003.2291295416.0000000000884000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp PID: 6740, type: MEMORYSTR

                              Remote Access Functionality

                              barindex
                              Yara detected PrivateLoader
                              Source: Yara matchFile source: 7.0.BitCometService.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 7.2.BitCometService.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 15.2.BitCometService.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 15.0.BitCometService.exe.400000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 5.2.BitComet_2.08a_setup.exe.2795664.2.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 5.2.BitComet_2.08a_setup.exe.2a24690.3.raw.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 5.2.BitComet_2.08a_setup.exe.2795664.2.raw.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 00000007.00000000.2218766402.0000000000401000.00000020.00000001.01000000.00000011.sdmp, type: MEMORY
                              Source: Yara matchFile source: 0000000F.00000000.2414944136.0000000000401000.00000020.00000001.01000000.00000011.sdmp, type: MEMORY
                              Source: Yara matchFile source: 0000000F.00000002.2966448744.0000000000401000.00000020.00000001.01000000.00000011.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000007.00000002.2219985855.0000000000401000.00000020.00000001.01000000.00000011.sdmp, type: MEMORY
                              Source: Yara matchFile source: C:\Program Files\BitComet\tools\BitCometService.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Program Files\BitComet\tools\VideoSnapshot.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\nsrA1A4.tmp, type: DROPPED
                              Yara detected QueryWinSAT ClassID
                              Source: Yara matchFile source: 00000001.00000003.2291295416.0000000000884000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp PID: 6740, type: MEMORYSTR

                              Mitre Att&ck Matrix

                              ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                              1
                              Software                              		1
                              Scripting                              		1
                              Valid Accounts                              		11
                              Native API                              		1
                              Scripting                              		1
                              DLL Side-Loading                              		2
                              Disable or Modify Tools                              		1
                              Network Sniffing                              		1
                              System Time Discovery                              		Remote Services11
                              Archive Collected Data                              		1
                              Ingress Tool Transfer                              		Exfiltration Over Other Network Medium1
                              Data Encrypted for Impact
                              CredentialsDomainsDefault Accounts14
                              Command and Scripting Interpreter                              		1
                              DLL Side-Loading                              		1
                              Valid Accounts                              		1
                              Deobfuscate/Decode Files or Information                              		LSASS Memory4
                              File and Directory Discovery                              		Remote Desktop Protocol1
                              Clipboard Data                              		21
                              Encrypted Channel                              		Exfiltration Over Bluetooth1
                              System Shutdown/Reboot
                              Email AddressesDNS ServerDomain Accounts1
                              Scheduled Task/Job                              		1
                              Valid Accounts                              		11
                              Access Token Manipulation                              		3
                              Obfuscated Files or Information                              		Security Account Manager1
                              Network Sniffing                              		SMB/Windows Admin SharesData from Network Shared Drive1
                              Non-Standard Port                              		Automated ExfiltrationData Encrypted for Impact
                              Employee NamesVirtual Private ServerLocal AccountsCron1
                              Windows Service                              		1
                              Windows Service                              		1
                              Software Packing                              		NTDS67
                              System Information Discovery                              		Distributed Component Object ModelInput Capture3
                              Non-Application Layer Protocol                              		Traffic DuplicationData Destruction
                              Gather Victim Network InformationServerCloud AccountsLaunchd1
                              Scheduled Task/Job                              		12
                              Process Injection                              		1
                              DLL Side-Loading                              		LSA Secrets1
                              Query Registry                              		SSHKeylogging14
                              Application Layer Protocol                              		Scheduled TransferData Encrypted for Impact
                              Domain PropertiesBotnetReplication Through Removable MediaScheduled Task1
                              Registry Run Keys / Startup Folder                              		1
                              Scheduled Task/Job                              		23
                              Masquerading                              		Cached Domain Credentials281
                              Security Software Discovery                              		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                              DNSWeb ServicesExternal Remote ServicesSystemd Timers1
                              Bootkit                              		1
                              Registry Run Keys / Startup Folder                              		1
                              Valid Accounts                              		DCSync15
                              Virtualization/Sandbox Evasion                              		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                              Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job15
                              Virtualization/Sandbox Evasion                              		Proc Filesystem3
                              Process Discovery                              		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                              Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt11
                              Modify Registry                              		/etc/passwd and /etc/shadow1
                              Application Window Discovery                              		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
                              IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron11
                              Access Token Manipulation                              		Network Sniffing2
                              System Owner/User Discovery                              		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
                              Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd12
                              Process Injection                              		Input Capture1
                              Remote System Discovery                              		Software Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption
                              Gather Victim Org InformationDNS ServerCompromise Software Supply ChainWindows Command ShellScheduled TaskScheduled Task1
                              Bootkit                              		KeyloggingProcess DiscoveryTaint Shared ContentScreen CaptureDNSExfiltration Over Physical MediumResource Hijacking

                              Behavior Graph

                              Hide Legend

                              Legend:

                              • Process
                              • Signature
                              • Created File
                              • DNS/IP Info
                              • Is Dropped
                              • Is Windows Process
                              • Number of created Registry Values
                              • Number of created Files
                              • Visual Basic
                              • Delphi
                              • Java
                              • .Net C# or VB.NET
                              • C, C++ or other language
                              • Is malicious
                              • Internet
                              behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1476246 Sample: SecuriteInfo.com.Riskware.O... Startdate: 18/07/2024 Architecture: WINDOWS Score: 46 130 www.bitcomet.com 2->130 132 v7event.stats.avast.com 2->132 134 21 other IPs or domains 2->134 162 Multi AV Scanner detection for submitted file 2->162 164 Yara detected PrivateLoader 2->164 166 NDIS Filter Driver detected (likely used to intercept and sniff network traffic) 2->166 168 4 other signatures 2->168 10 SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe 2 2->10         started        13 BitComet.exe 2->13         started        16 svchost.exe 2->16         started        18 3 other processes 2->18 signatures3 process4 dnsIp5 122 SecuriteInfo.com.R...rCore.5002.4698.tmp, PE32 10->122 dropped 20 SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp 5 28 10->20         started        154 146.12.137.105 TRAVIANGAMESDE United States 13->154 156 dht.transmissionbt.com 87.98.162.88 OVHFR France 13->156 158 161.97.134.106, 49788, 5437 CONTABODE United States 13->158 25 msedgewebview2.exe 13->25         started        27 UPNP.exe 13->27         started        29 UPNP.exe 13->29         started        31 WerFault.exe 16->31         started        33 WerFault.exe 16->33         started        160 127.0.0.1 unknown unknown 18->160 file6 process7 dnsIp8 146 d11iilsblp9z11.cloudfront.net 13.249.12.125, 443, 49734, 49735 AMAZON-02US United States 20->146 148 143.204.205.88, 443, 49750, 49753 AMAZON-02US United States 20->148 90 C:\Users\user\AppData\...\zbShieldUtils.dll, PE32 20->90 dropped 92 C:\Users\...\avg_antivirus_free_setup.exe, PE32 20->92 dropped 94 C:\Users\user\AppData\Local\...\saBSI.exe, PE32 20->94 dropped 102 7 other files (6 malicious) 20->102 dropped 180 Writes many files with high entropy 20->180 35 avg_antivirus_free_setup.exe 20->35         started        40 saBSI.exe 10 8 20->40         started        42 BitComet_2.08a_setup.exe 67 141 20->42         started        50 3 other processes 20->50 96 C:\Users\...\topTraffic_638004170464094982, raw 25->96 dropped 98 topTraffic_1705401...0506234197983529371, data 25->98 dropped 100 C:\Users\user\AppData\Local\...\topTraffic, ASCII 25->100 dropped 104 4 other malicious files 25->104 dropped 44 msedgewebview2.exe 25->44         started        46 msedgewebview2.exe 25->46         started        48 msedgewebview2.exe 25->48         started        52 7 other processes 25->52 150 239.255.255.250 unknown Reserved 27->150 file9 signatures10 process11 dnsIp12 136 analytics-prod-gcp.ff.avast.com 34.117.223.223, 443, 49755, 49760 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 35->136 78 C:\...\avg_antivirus_free_online_setup.exe, PE32 35->78 dropped 174 Query firmware table information (likely to detect VMs) 35->174 176 Contains functionality to infect the boot sector 35->176 54 avg_antivirus_free_online_setup.exe 35->54         started        138 mosaic-orio.apis.mcafee.com 52.25.171.187, 443, 49751, 49752 AMAZON-02US United States 40->138 80 C:\Users\user\AppData\Local\...\installer.exe, PE32+ 40->80 dropped 178 Writes many files with high entropy 40->178 58 installer.exe 40->58         started        82 C:\Users\user\AppData\...\BitCometService.exe, PE32 42->82 dropped 84 C:\Users\user\AppData\...\BcNsisHelperXP.dll, PE32 42->84 dropped 86 C:\Users\user\AppData\...\BcNsisHelper.dll, PE32 42->86 dropped 88 20 other files (7 malicious) 42->88 dropped 60 BitComet_stats.exe 14 42->60         started        63 BitCometService.exe 1 42->63         started        140 142.250.65.200, 443, 49816 GOOGLEUS United States 44->140 142 apphit.com 95.111.225.211, 443, 49796, 49797 CONTABODE Ukraine 44->142 144 5 other IPs or domains 44->144 file13 signatures14 process15 dnsIp16 106 C:\Windows\Temp\...\icarus_ui.exe, PE32+ 54->106 dropped 108 C:\Windows\Temp\...\icarus_mod.dll, PE32 54->108 dropped 110 C:\Windows\Temp\...\icarus.exe, PE32+ 54->110 dropped 118 9 other malicious files 54->118 dropped 182 Query firmware table information (likely to detect VMs) 54->182 184 Contains functionality to infect the boot sector 54->184 186 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 54->186 65 icarus.exe 54->65         started        112 C:\Program Files\McAfee\...\wssdep.cab, Microsoft 58->112 dropped 114 C:\Program Files\McAfee\...\wataskmanager.cab, Microsoft 58->114 dropped 116 C:\Program Files\McAfee\...\updater.cab, Microsoft 58->116 dropped 120 18 other files (16 malicious) 58->120 dropped 188 Writes a notice file (html or txt) to demand a ransom 58->188 190 Writes many files with high entropy 58->190 152 bitcomet.com 161.97.135.85, 443, 49747, 49776 CONTABODE United States 60->152 file17 signatures18 process19 dnsIp20 124 shepherd-gcp.ff.avast.com 34.160.176.28 ATGS-MMD-ASUS United States 65->124 126 shepherd.ff.avast.com 65->126 128 5 other IPs or domains 65->128 70 C:\Windows\Temp\...\icarus_ui.exe, PE32+ 65->70 dropped 72 C:\Windows\Temp\...\icarus_rvrt.exe, PE32+ 65->72 dropped 74 C:\Windows\Temp\...\icarus_product.dll, PE32+ 65->74 dropped 76 18 other malicious files 65->76 dropped 170 Query firmware table information (likely to detect VMs) 65->170 172 Writes many files with high entropy 65->172 file21 signatures22

                              Screenshots

                              Thumbnails

                              This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                              windows-stand

                              Antivirus, Machine Learning and Genetic Malware Detection

                              Initial Sample

                              SourceDetectionScannerLabelLink
                              SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe18%ReversingLabsWin32.PUA.OfferCore

                              Dropped Files

                              SourceDetectionScannerLabelLink
                              C:\Program Files\BitComet\BitComet.exe4%ReversingLabs
                              C:\Program Files\BitComet\CrashReport.exe0%ReversingLabs
                              C:\Program Files\BitComet\WebView2Loader.dll0%ReversingLabs
                              C:\Program Files\BitComet\tools\BitCometAgent_1.92.7.9.dll0%ReversingLabs
                              C:\Program Files\BitComet\tools\BitCometBHO_1.5.4.11.dll0%ReversingLabs
                              C:\Program Files\BitComet\tools\BitCometService.exe0%ReversingLabs
                              C:\Program Files\BitComet\tools\BitCometToastsNotifier.exe0%ReversingLabs
                              C:\Program Files\BitComet\tools\ChromeLauncher.exe0%ReversingLabs
                              C:\Program Files\BitComet\tools\UPNP.exe0%ReversingLabs
                              C:\Program Files\BitComet\tools\Updater.exe9%ReversingLabs
                              C:\Program Files\BitComet\tools\VideoSnapshot.exe0%ReversingLabs
                              C:\Program Files\BitComet\uninst.exe0%ReversingLabs
                              C:\Program Files\McAfee\Temp1561643107\installer.exe0%ReversingLabs
                              C:\Program Files\McAfee\Temp1561643107\resource.dll0%ReversingLabs
                              C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp0%ReversingLabs
                              C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe (copy)17%ReversingLabs
                              C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\_isetup\_setup64.tmp0%ReversingLabs
                              C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\is-3V26O.tmp17%ReversingLabs
                              C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe0%ReversingLabs
                              C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exe0%ReversingLabs
                              C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exe0%ReversingLabs
                              C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\zbShieldUtils.dll5%ReversingLabs
                              C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BcNsisHelper.dll0%ReversingLabs
                              C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BcNsisHelperXP.dll0%ReversingLabs
                              C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitCometService.exe0%ReversingLabs
                              C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe0%ReversingLabs
                              C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\System.dll3%ReversingLabs
                              C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\http_Downloader.exe0%ReversingLabs
                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av-vps\bug_report.exe0%ReversingLabs
                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av-vps\dump_process.exe0%ReversingLabs
                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av-vps\icarus.exe0%ReversingLabs
                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av-vps\icarus_product.dll0%ReversingLabs
                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av-vps\icarus_rvrt.exe0%ReversingLabs
                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\aswOfferTool.exe0%ReversingLabs
                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\bug_report.exe0%ReversingLabs
                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\dump_process.exe0%ReversingLabs
                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\icarus.exe0%ReversingLabs
                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\icarus_product.dll0%ReversingLabs
                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\icarus_rvrt.exe0%ReversingLabs
                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\icarus_ui.exe0%ReversingLabs
                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\bug_report.exe0%ReversingLabs
                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\dump_process.exe0%ReversingLabs
                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe0%ReversingLabs
                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus_mod.dll0%ReversingLabs
                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus_ui.exe0%ReversingLabs
                              C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe0%ReversingLabs

                              Unpacked PE Files

                              ⊘No Antivirus matches

                              Domains

                              ⊘No Antivirus matches

                              URLs

                              SourceDetectionScannerLabelLink
                              https://www.remobjects.com/ps0%URL Reputationsafe
                              https://www.innosetup.com/0%URL Reputationsafe
                              http://www.certum.pl/CPS00%URL Reputationsafe
                              https://honzik.avcdn.net/universe/2445/f8a0/b75b/2445f8a0b75beb1a77428c2d605189876222fb9d53e3b187f7b0%Avira URL Cloudsafe
                              https://sadownload.mcafee.com:443/products/SA/v1/installer/4.1.1/914/64/installer.exe0%Avira URL Cloudsafe
                              https://d11iilsblp9z11.cloudfront.net/f/AVG_AV/files/1319/avg.zipI.ziI0%Avira URL Cloudsafe
                              https://sadownload.mcafee.com/t0%Avira URL Cloudsafe
                              https://d11iilsblp9z11.cloudfront.net/f/AVG_AV/files/1319/avg.zip0%Avira URL Cloudsafe
                              https://webcompanion.com/terms0%Avira URL Cloudsafe
                              https://sadownload.mcafee.com/r0%Avira URL Cloudsafe
                              https://d11iilsblp9z11.cloudfront.net/f/AVG_AV/images/1509/EN.pngngzA5vE30PraTCAoRM4emN7pEfhIdll0%Avira URL Cloudsafe
                              http://download.bitcomet.com/bitcomet/bitcomet_setup.exe0%Avira URL Cloudsafe
                              https://honzik.avcdn.net:443/universe/9fcc/f245/57f7/9fccf24557f7691f06726fa651a35b48bdbac4556cb63180%Avira URL Cloudsafe
                              https://sadownload.mcafee.com/products/SA/BSI/bsi_DistributionRules.xml/0%Avira URL Cloudsafe
                              https://home.mcafee.com/Root/AboutUs.aspx?id=eula0%Avira URL Cloudsafe
                              https://buddies.uno/Software/PrivacyPolicy/PrivayPolicy.htm_ZHg0%Avira URL Cloudsafe
                              https://www.avg.com/ww-en/privacynet/r0%Avira URL Cloudsafe
                              https://analytics.apis.mcafee.comse0%Avira URL Cloudsafe
                              https://honzik.avcdn.net/defs/avg-av/release.xml.lzma0%Avira URL Cloudsafe
                              https://buddies.uno/Software/PrivacyPolicy/Privao0%Avira URL Cloudsafe
                              https://www.mcafee.com/consumer/en-us/policy/legal.htmld0%Avira URL Cloudsafe
                              https://analytics.apis.mcafee.com/mosaic/2.0/product-web/am/v1/recorder0%Avira URL Cloudsafe
                              https://www.premieropinion.com/common/termsofservice-v10%Avira URL Cloudsafe
                              https://d11iilsblp9z11.cloudfront.net/zbd0%Avira URL Cloudsafe
                              https://honzik.avcdn.net/universe/d936/7c5e/474b/d9367c5e474bca83cb06f583f2fb42ef2517d769cc82722201a0%Avira URL Cloudsafe
                              https://cdn.pawns.app/download/sdk/latest/windows/pawns-sdk.dll0%Avira URL Cloudsafe
                              https://firefoxextension.avast.com/aos/update.json0%Avira URL Cloudsafe
                              https://sadownload.mcafee.com/products/sa/bsi/win/binary/0%Avira URL Cloudsafe
                              https://www.avg.com/ww-en/privacynet/j0%Avira URL Cloudsafe
                              https://www.mcafee.com/consumer/en-us/policy/legal.html5Z0%Avira URL Cloudsafe
                              https://sadownload.mcafee.com/U0%Avira URL Cloudsafe
                              https://www.mcafee.com/consumer/en-us/policy/legal.htmlr0%Avira URL Cloudsafe
                              https://www.avg.com/ww-en/eula/en-us/0%Avira URL Cloudsafe
                              http://submit.fileshot.net/query/POST3api_versionvl_hashfile_size0%Avira URL Cloudsafe
                              https://buddies.uno/Software/PrivacyPolicy/Pri0%Avira URL Cloudsafe
                              https://d11iilsblp9z11.cloudfront.net/f/AVG_AV/files/1319/avg.zipI.zi60%Avira URL Cloudsafe
                              https://analytics.avcdn.net:443/v4/receive/json/25t0%Avira URL Cloudsafe
                              https://sadownload.mcafee.com/products/SA/BSI/bsi_abtest.xml0%Avira URL Cloudsafe
                              https://winqual.sb.avast.com0%Avira URL Cloudsafe
                              https://buddies.uno/Software/Eula/eula.htm0%Avira URL Cloudsafe
                              https://sadownload.mcafee.com/G0%Avira URL Cloudsafe
                              http://www.winimage.com/zLibDllDELETEPUTCONNECTTRACECOPYLOCKMKCOLMOVEPROPFINDPROPPATCHSEARCHUNLOCKBI0%Avira URL Cloudsafe
                              https://www.mcafee.com/consumer/v/wa-how.htmlD0%Avira URL Cloudsafe
                              ftp://http://%.20s%ddefault%d%.20scopying0%Avira URL Cloudsafe
                              https://www.mcafee.com/consumer/en-us/policy/global/lega0%Avira URL Cloudsafe
                              http://ccsca2021.ocsp-certum.com050%Avira URL Cloudsafe
                              https://d11iilsblp9z11.cloudfront.net/f/AVG_AV/files/1319/avg.zipi0%Avira URL Cloudsafe
                              https://my.avast.com0%Avira URL Cloudsafe
                              https://www.mcafee.com/consumer/en-us/policy/legal.html$Z0%Avira URL Cloudsafe
                              https://inside.bitcomet.com/start/en_us/2.08/0%Avira URL Cloudsafe
                              https://analytics.avcdn.net/v4/receive/json/25Sent0%Avira URL Cloudsafe
                              https://apphit.com/?random=1&style=iframe0%Avira URL Cloudsafe
                              https://d11iilsblp9z11.cloudfront.net/f/WebAdvisor/files/1489/saBSI.zipEC80%Avira URL Cloudsafe
                              https://www.mcafee.com/consumer/v/wa-how.html60%Avira URL Cloudsafe
                              https://www.bitcomet.com/client/install-stats/?l=en_us&file=BitComet_2.08a_setup.exe&p=x64C:0%Avira URL Cloudsafe
                              https://www.avg.com/ww-en/privacynet/f/WebAdvisor/images/NEW/EN.pngipS0%Avira URL Cloudsafe
                              https://sadownload.mcafee.com/products/SA/BSI/bsi_PartnerDistribution.xml0%Avira URL Cloudsafe
                              https://www.winzip.com/win/en/privacy.html0%Avira URL Cloudsafe
                              http://mirror.com/pub/file.exe0%Avira URL Cloudsafe
                              https://www.avg.com/ww-en/privacy-us/K0%Avira URL Cloudsafe
                              https://www.bitcomet.com/client/install-stats/?l=en_us&file=BitComet_2.08a_setup.exe&p=x64=0%Avira URL Cloudsafe
                              https://image.apphit.com/image/app/veracrypt/veracrypt-logo.svg0%Avira URL Cloudsafe
                              https://id.avast.com/inAvastium0%Avira URL Cloudsafe
                              https://www.avast.com/eula#pc0%Avira URL Cloudsafe
                              https://buddies.uno/Software/PrivacyPolicy/PrivayPolicy0%Avira URL Cloudsafe
                              https://shepherd.avcdn.net0%Avira URL Cloudsafe
                              https://www.bitcomet.com/client/install-stats/?l=en_us&file=BitComet_2.08a_setup.exe&p=x64;0%Avira URL Cloudsafe
                              https://www.bitcomet.com/client/install-stats/?l=en_us&file=BitComet_2.08a_setup.exe&p=x64:0%Avira URL Cloudsafe
                              https://honzik.avcdn.net/universe/4d26/a67d/9fb8/4d26a67d9fb882ba9ddb9a8f90cfc0a1f17c5f526abb83671f60%Avira URL Cloudsafe
                              https://www.avg.com/ww-en/eulaL0%Avira URL Cloudsafe
                              https://sadownload.mcafee.com:443/products/SA/BSI/bsi_DistributionRules.xmlRECONDITION0%Avira URL Cloudsafe
                              https://www.avg.com/ww-en/0%Avira URL Cloudsafe
                              https://www.opera.com/he/eula/computers0%Avira URL Cloudsafe
                              https://update.bitcomet.com/client/bitcomet/?ver=2.08&intl=en_us&osintl=jv&cid=ae7b79c1d0de3420440a531a8fc59151&btcnt=0&httpcnt=0&p=x64&idt=202407180%Avira URL Cloudsafe
                              http://127.0.0.10%Avira URL Cloudsafe
                              https://www.bitcomet.com/client/install-stats/?l=en_us&file=BitComet_2.08a_setup.exe&p=x64R0%Avira URL Cloudsafe
                              https://sadownload.mcafee.com/products/SA/v1/installer/4.1.1/914/0%Avira URL Cloudsafe
                              https://www.mcafee.com/consumer/v/wa-how.htmlY0%Avira URL Cloudsafe
                              https://www.360totalsecurity.com/en/license/u=0%Avira URL Cloudsafe
                              https://analytics.apis.mcafee.com:443/mosaic/2.0/product-web/am/v1/recordY_DIST_AFFID_LIST0%Avira URL Cloudsafe
                              https://honzik.avcdn.net/setup/avg-av/release/avg_antivirus_free_online_setup.exe0%Avira URL Cloudsafe
                              https://pair.ff.avast.com0%Avira URL Cloudsafe
                              https://sadownload.mcafee.com/products/SA/BSI/bsi_DistributionRulesISB.xml0%Avira URL Cloudsafe
                              http://https://:allow_fallback/installer.exe0%Avira URL Cloudsafe
                              https://sadownload.mcafee.com/products/SA/v1/bsi/4.1.1/install.xmlhe0%Avira URL Cloudsafe
                              http://submit.sb.avast.com/V1/PD/0%Avira URL Cloudsafe
                              https://analytics.apis.mcafee.comhttps://analytics.qa.apis.mcafee.com/mosaic/2.0/product-web/am/v1/r0%Avira URL Cloudsafe
                              https://www.bitcomet.com/doc/privacy-policy.php0%Avira URL Cloudsafe
                              https://sadownload.mcafee.com/products/SA/BSI/bsi_PartnerDistribution.xml/0%Avira URL Cloudsafe
                              https://www.bitcomet.com/client/install-stats/?l=en_us&file=BitComet_2.08a_setup.exe&p=x64(0%Avira URL Cloudsafe
                              https://viruslab-samples.sb.avast.com0%Avira URL Cloudsafe
                              https://sadownload.mcafee.com/products/SA/v1/bsi0%Avira URL Cloudsafe
                              https://www.bitcomet.com/client/install-stats/?l=en_us&file=BitComet_2.08a_setup.exe&p=x64.0%Avira URL Cloudsafe
                              https://d11iilsblp9z11.cloudfront.net/f/AVG_AV/images/1509/EN.pngI.zip0%Avira URL Cloudsafe
                              https://analytics.apis.mcafee.com/0%Avira URL Cloudsafe
                              https://sadownload.mcafee.com/products/SA/BSI/bsi_vars.x0%Avira URL Cloudsafe
                              https://www.winzip.com/win/en/eula.html0%Avira URL Cloudsafe
                              https://sadownload.mcafee.com/products/sa/bsi/win/binary0%Avira URL Cloudsafe
                              https://home.mcafee.com/Root/AboutUs.aspx?iu0%Avira URL Cloudsafe
                              http://v7event.stats.avast.com:80/cgi-bin/iavsevents.cgi0%Avira URL Cloudsafe

                              Domains and IPs

                              Contacted Domains

                              NameIPActiveMaliciousAntivirus DetectionReputation
                              dht.transmissionbt.com
                              		87.98.162.88
                              		truefalse
                                		unknown
                                mosaic-orio.apis.mcafee.com
                                		52.25.171.187
                                		truefalse
                                  		unknown
                                  chrome.cloudflare-dns.com
                                  		172.64.41.3
                                  		truefalse
                                    		unknown
                                    apphit.com
                                    		95.111.225.211
                                    		truefalse
                                      		unknown
                                      shepherd-gcp.ff.avast.com
                                      		34.160.176.28
                                      		truefalse
                                        		unknown
                                        inside.bitcomet.com
                                        		161.97.135.85
                                        		truefalse
                                          		unknown
                                          update.bitcomet.com
                                          		161.97.135.85
                                          		truefalse
                                            		unknown
                                            prod.globalsign.map.fastly.net
                                            		151.101.2.133
                                            		truefalse
                                              		unknown
                                              analytics-prod-gcp.ff.avast.com
                                              		34.117.223.223
                                              		truefalse
                                                		unknown
                                                d11iilsblp9z11.cloudfront.net
                                                		13.249.12.125
                                                		truefalse
                                                  		unknown
                                                  bitcomet.com
                                                  		161.97.135.85
                                                  		truefalse
                                                    		unknown
                                                    analytics.apis.mcafee.com
                                                    		unknown
                                                    		unknownfalse
                                                      		unknown
                                                      sadownload.mcafee.com
                                                      		unknown
                                                      		unknownfalse
                                                        		unknown
                                                        router.silotis.us
                                                        		unknown
                                                        		unknownfalse
                                                          		unknown
                                                          dht.libtorrent.org
                                                          		unknown
                                                          		unknownfalse
                                                            		unknown
                                                            v7event.stats.avast.com
                                                            		unknown
                                                            		unknownfalse
                                                              		unknown
                                                              router.bittorrent.com
                                                              		unknown
                                                              		unknownfalse
                                                                		unknown
                                                                www.bitcomet.com
                                                                		unknown
                                                                		unknownfalse
                                                                  		unknown
                                                                  shepherd.avcdn.net
                                                                  		unknown
                                                                  		unknownfalse
                                                                    		unknown
                                                                    appassets.bitcomet.com
                                                                    		unknown
                                                                    		unknownfalse
                                                                      		unknown
                                                                      router.utorrent.com
                                                                      		unknown
                                                                      		unknownfalse
                                                                        		unknown
                                                                        analytics.avcdn.net
                                                                        		unknown
                                                                        		unknownfalse
                                                                          		unknown
                                                                          honzik.avcdn.net
                                                                          		unknown
                                                                          		unknownfalse
                                                                            		unknown

                                                                            Contacted URLs

                                                                            NameMaliciousAntivirus DetectionReputation
                                                                            https://d11iilsblp9z11.cloudfront.net/f/AVG_AV/files/1319/avg.zipfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://d11iilsblp9z11.cloudfront.net/zbdfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://inside.bitcomet.com/start/en_us/2.08/false
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://apphit.com/?random=1&style=iframefalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://image.apphit.com/image/app/veracrypt/veracrypt-logo.svgfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://update.bitcomet.com/client/bitcomet/?ver=2.08&intl=en_us&osintl=jv&cid=ae7b79c1d0de3420440a531a8fc59151&btcnt=0&httpcnt=0&p=x64&idt=20240718false
                                                                            • Avira URL Cloud: safe
                                                                            		unknown

                                                                            URLs from Memory and Binaries

                                                                            NameSourceMaliciousAntivirus DetectionReputation
                                                                            https://d11iilsblp9z11.cloudfront.net/f/AVG_AV/images/1509/EN.pngngzA5vE30PraTCAoRM4emN7pEfhIdllSecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.000000000082E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://sadownload.mcafee.com:443/products/SA/v1/installer/4.1.1/914/64/installer.exesaBSI.exe, 0000000A.00000003.2719167639.0000000002EE3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://webcompanion.com/termsSecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000828000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760509842.000000000085F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.000000000082E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://sadownload.mcafee.com/tsaBSI.exe, 0000000A.00000003.2720973329.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720589934.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2721125963.0000000002F1F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://sadownload.mcafee.com/rsaBSI.exe, 0000000A.00000003.2444175220.0000000002F2A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://honzik.avcdn.net:443/universe/9fcc/f245/57f7/9fccf24557f7691f06726fa651a35b48bdbac4556cb6318avg_antivirus_free_online_setup.exe, 0000000C.00000002.2976217934.0000000003517000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://d11iilsblp9z11.cloudfront.net/f/AVG_AV/files/1319/avg.zipI.ziISecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2635025040.0000000004EE5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2411164366.0000000004EE4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://honzik.avcdn.net/universe/2445/f8a0/b75b/2445f8a0b75beb1a77428c2d605189876222fb9d53e3b187f7bavg_antivirus_free_online_setup.exe, 0000000C.00000003.2454099658.0000000003571000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            http://download.bitcomet.com/bitcomet/bitcomet_setup.exeBitComet.exe, 0000000D.00000000.2403166450.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://home.mcafee.com/Root/AboutUs.aspx?id=eulaSecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.000000000085C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.0000000000842000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1778301135.000000000085C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://sadownload.mcafee.com/products/SA/BSI/bsi_DistributionRules.xml/saBSI.exe, 0000000A.00000003.2401095516.0000000005404000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://buddies.uno/Software/PrivacyPolicy/PrivayPolicy.htm_ZHgSecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000828000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://analytics.apis.mcafee.comsesaBSI.exe, 0000000A.00000002.2897708570.0000000002E64000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2896422358.0000000002E63000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://honzik.avcdn.net/defs/avg-av/release.xml.lzmaavg_antivirus_free_online_setup.exe, 0000000C.00000003.2403613513.0000000003571000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2405758044.0000000003571000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://www.premieropinion.com/common/termsofservice-v1SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2627572791.0000000003622000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000828000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760509842.000000000085F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1778301135.0000000000824000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.0000000000824000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.0000000000824000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://buddies.uno/Software/PrivacyPolicy/PrivaoSecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000828000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://www.avg.com/ww-en/privacynet/rSecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.000000000082E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://www.mcafee.com/consumer/en-us/policy/legal.htmldSecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110764000.0000000000809000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://analytics.apis.mcafee.com/mosaic/2.0/product-web/am/v1/recordersaBSI.exe, 0000000A.00000003.2884586261.0000000005405000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000002.2900191307.0000000005405000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2486584163.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2884328927.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2718431117.0000000005404000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://cdn.pawns.app/download/sdk/latest/windows/pawns-sdk.dllBitComet.exe, 0000000D.00000002.2420857876.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmp, BitComet.exe, 0000000D.00000000.2403166450.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://honzik.avcdn.net/universe/d936/7c5e/474b/d9367c5e474bca83cb06f583f2fb42ef2517d769cc82722201aavg_antivirus_free_online_setup.exe, 0000000C.00000003.2574209553.0000000003571000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://firefoxextension.avast.com/aos/update.jsonavg_antivirus_free_online_setup.exe, 0000000C.00000003.2604061607.0000000005C6A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://sadownload.mcafee.com/products/sa/bsi/win/binary/saBSI.exe, 0000000A.00000003.2883408378.0000000005421000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2729383650.0000000005421000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2884257310.0000000005421000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2731341920.0000000005421000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2718431117.0000000005421000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2486584163.0000000005421000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720457018.0000000005421000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://www.avg.com/ww-en/privacynet/jSecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2637685057.0000000004F5F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2409204675.0000000004F5E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2409753961.0000000004F5F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://sadownload.mcafee.com/UsaBSI.exe, 0000000A.00000003.2444175220.0000000002F2A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://www.avg.com/ww-en/eula/en-us/SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2360300158.0000000004F5D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2361467884.0000000004F54000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2363199165.0000000004F68000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2409204675.0000000004F6A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://www.mcafee.com/consumer/en-us/policy/legal.html5ZSecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000828000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1778301135.0000000000824000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.0000000000824000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.0000000000824000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://www.mcafee.com/consumer/en-us/policy/legal.htmlrSecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.0000000000809000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://www.remobjects.com/psSecuriteInfo.com.Riskware.OfferCore.5002.4698.exe, 00000000.00000003.1700603344.000000007FB50000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe, 00000000.00000003.1698345675.00000000026B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000000.1702051510.0000000000401000.00000020.00000001.01000000.00000004.sdmpfalse
                                                                            • URL Reputation: safe
                                                                            		unknown
                                                                            https://d11iilsblp9z11.cloudfront.net/f/AVG_AV/files/1319/avg.zipI.zi6SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2363617302.0000000004EE0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            http://submit.fileshot.net/query/POST3api_versionvl_hashfile_sizeBitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://sadownload.mcafee.com/products/SA/BSI/bsi_abtest.xmlsaBSI.exe, 0000000A.00000003.2444175220.0000000002F2A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2884328927.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2718431117.0000000005404000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://buddies.uno/Software/PrivacyPolicy/PriSecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000828000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://www.innosetup.com/SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe, 00000000.00000003.1700603344.000000007FB50000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe, 00000000.00000003.1698345675.00000000026B0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000000.1702051510.0000000000401000.00000020.00000001.01000000.00000004.sdmpfalse
                                                                            • URL Reputation: safe
                                                                            		unknown
                                                                            https://winqual.sb.avast.comavg_antivirus_free_online_setup.exe, 0000000C.00000003.2577221124.0000000005DA0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://analytics.avcdn.net:443/v4/receive/json/25tavg_antivirus_free_online_setup.exe, 0000000C.00000002.2976217934.0000000003517000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://sadownload.mcafee.com/GsaBSI.exe, 0000000A.00000003.2444175220.0000000002F2A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://buddies.uno/Software/Eula/eula.htmSecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000815000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://www.mcafee.com/consumer/v/wa-how.htmlDsaBSI.exe, 0000000A.00000002.2897708570.0000000002E64000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2896422358.0000000002E63000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            http://www.winimage.com/zLibDllDELETEPUTCONNECTTRACECOPYLOCKMKCOLMOVEPROPFINDPROPPATCHSEARCHUNLOCKBIavg_antivirus_free_online_setup.exe, 0000000C.00000003.2504355859.0000000006006000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            http://ccsca2021.ocsp-certum.com05BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://www.mcafee.com/consumer/en-us/policy/global/legaSecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.000000000085C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1778301135.000000000085C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            ftp://http://%.20s%ddefault%d%.20scopyingBitComet_2.08a_setup.exe, 00000005.00000002.2249442158.000000000276B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://d11iilsblp9z11.cloudfront.net/f/AVG_AV/files/1319/avg.zipiSecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2642171583.000000000756D000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://my.avast.comavg_antivirus_free_online_setup.exe, 0000000C.00000003.2628849428.0000000005C36000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://www.mcafee.com/consumer/en-us/policy/legal.html$ZSecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000828000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1778301135.0000000000824000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.0000000000824000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.0000000000824000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            http://www.certum.pl/CPS0SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110344218.0000000004EDD000.00000004.00000020.00020000.00000000.sdmp, BitComet_2.08a_setup.exe, 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmp, BitComet_2.08a_setup.exe, 00000005.00000003.2216838446.00000000030F3000.00000004.00000020.00020000.00000000.sdmp, BitComet.exe, 0000000D.00000003.2405439939.0000023E833A5000.00000004.00001000.00020000.00000000.sdmp, BitComet.exe, 0000000E.00000003.2413441796.0000021F09335000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                            • URL Reputation: safe
                                                                            		unknown
                                                                            https://analytics.avcdn.net/v4/receive/json/25Sentavg_antivirus_free_online_setup.exe, 0000000C.00000002.2995522970.0000000005490000.00000002.00000001.00040000.00000018.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000000.2390280020.0000000000DC7000.00000002.00000001.01000000.00000018.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000002.2964747983.0000000000DC7000.00000002.00000001.01000000.00000018.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://d11iilsblp9z11.cloudfront.net/f/WebAdvisor/files/1489/saBSI.zipEC8SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.000000000085C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2409204675.0000000004F36000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2362643784.0000000004F42000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2361027589.0000000004F3A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2636705232.0000000004F47000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://www.mcafee.com/consumer/v/wa-how.html6saBSI.exe, 0000000A.00000002.2897708570.0000000002E64000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2896422358.0000000002E63000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://www.avg.com/ww-en/privacynet/f/WebAdvisor/images/NEW/EN.pngipSSecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.000000000085C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://www.bitcomet.com/client/install-stats/?l=en_us&file=BitComet_2.08a_setup.exe&p=x64C:BitComet_2.08a_setup.exe, 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmp, BitComet_stats.exe, 00000008.00000002.2229356875.00000000004E0000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000002.2229464470.0000000000670000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://sadownload.mcafee.com/products/SA/BSI/bsi_PartnerDistribution.xmlsaBSI.exe, 0000000A.00000003.2730262487.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2401223602.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720973329.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2884883686.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720589934.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2730852804.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2721125963.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002F1E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://www.winzip.com/win/en/privacy.htmlSecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.0000000000818000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.0000000000818000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760509842.000000000085F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1778301135.0000000000818000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000815000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2618744694.000000000081A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://www.avg.com/ww-en/privacy-us/KSecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2637685057.0000000004F5F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2409204675.0000000004F5E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2409753961.0000000004F5F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            http://mirror.com/pub/file.exeBitComet.exe, 0000000D.00000002.2420857876.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmp, BitComet.exe, 0000000D.00000000.2403166450.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://id.avast.com/inAvastiumavg_antivirus_free_online_setup.exe, 0000000C.00000003.2628849428.0000000005C36000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://www.bitcomet.com/client/install-stats/?l=en_us&file=BitComet_2.08a_setup.exe&p=x64=BitComet_stats.exe, 00000008.00000003.2228323587.00000000006C3000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000002.2230194299.00000000006C5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://shepherd.avcdn.netavg_antivirus_free_online_setup.exe, 0000000C.00000003.2604061607.0000000005C6A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://buddies.uno/Software/PrivacyPolicy/PrivayPolicySecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000828000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://www.avast.com/eula#pcSecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2627572791.0000000003622000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.000000000083F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.0000000000854000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000828000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760509842.000000000085F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1778301135.0000000000854000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://www.bitcomet.com/client/install-stats/?l=en_us&file=BitComet_2.08a_setup.exe&p=x64:BitComet_stats.exe, 00000008.00000003.2228323587.00000000006CF000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000003.2228442765.00000000006CF000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000002.2230297660.00000000006CF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://honzik.avcdn.net/universe/4d26/a67d/9fb8/4d26a67d9fb882ba9ddb9a8f90cfc0a1f17c5f526abb83671f6avg_antivirus_free_online_setup.exe, 0000000C.00000003.2536687235.0000000003571000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://www.bitcomet.com/client/install-stats/?l=en_us&file=BitComet_2.08a_setup.exe&p=x64;BitComet_stats.exe, 00000008.00000003.2228323587.00000000006C3000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000002.2230194299.00000000006C5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://sadownload.mcafee.com:443/products/SA/BSI/bsi_DistributionRules.xmlRECONDITIONsaBSI.exe, 0000000A.00000003.2719167639.0000000002F1E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://www.avg.com/ww-en/SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2642171583.0000000007566000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://www.avg.com/ww-en/eulaLSecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.000000000082E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://www.opera.com/he/eula/computersSecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760509842.000000000085F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.000000000087D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.000000000087D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1778301135.0000000000818000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000815000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2618744694.000000000081A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://www.bitcomet.com/client/install-stats/?l=en_us&file=BitComet_2.08a_setup.exe&p=x64RBitComet_stats.exe, 00000008.00000002.2228633981.0000000000190000.00000004.00000010.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            http://127.0.0.1BitComet.exe, 0000000D.00000002.2420857876.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmp, BitComet.exe, 0000000D.00000000.2403166450.00007FF664E1C000.00000002.00000001.01000000.00000019.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://sadownload.mcafee.com/products/SA/v1/installer/4.1.1/914/saBSI.exe, 0000000A.00000003.2730262487.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720973329.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2884883686.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002EBA000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720589934.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2730852804.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2721125963.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002EB9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://www.mcafee.com/consumer/v/wa-how.htmlYsaBSI.exe, 0000000A.00000002.2897708570.0000000002E64000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2896422358.0000000002E63000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://www.360totalsecurity.com/en/license/u=SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.0000000000818000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.0000000000818000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1778301135.0000000000818000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000815000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2618744694.000000000081A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://honzik.avcdn.net/setup/avg-av/release/avg_antivirus_free_online_setup.exeavg_antivirus_free_setup.exe, 0000000B.00000002.2971743307.0000000004DFA000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_online_setup.exe, 0000000C.00000003.2628849428.0000000005C36000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://pair.ff.avast.comavg_antivirus_free_online_setup.exe, 0000000C.00000003.2628849428.0000000005C36000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://sadownload.mcafee.com/products/SA/BSI/bsi_DistributionRulesISB.xmlsaBSI.exe, 0000000A.00000003.2401223602.0000000002F04000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000002.2897708570.0000000002EE3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2896027780.0000000002EE3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002EE3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002EE3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://analytics.apis.mcafee.com:443/mosaic/2.0/product-web/am/v1/recordY_DIST_AFFID_LISTsaBSI.exe, 0000000A.00000003.2719167639.0000000002EE3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://sadownload.mcafee.com/products/SA/v1/bsi/4.1.1/install.xmlhesaBSI.exe, 0000000A.00000002.2897708570.0000000002EB9000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2895072615.0000000002EB9000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002EBA000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002EB9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            http://https://:allow_fallback/installer.exeavg_antivirus_free_setup.exe, 0000000B.00000000.2364390202.00000000000C3000.00000002.00000001.01000000.00000017.sdmp, avg_antivirus_free_setup.exe, 0000000B.00000002.2963084059.00000000000C3000.00000002.00000001.01000000.00000017.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            http://submit.sb.avast.com/V1/PD/avg_antivirus_free_online_setup.exe, 0000000C.00000003.2628849428.0000000005C36000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://analytics.apis.mcafee.comhttps://analytics.qa.apis.mcafee.com/mosaic/2.0/product-web/am/v1/rsaBSI.exe, 0000000A.00000000.2344892193.00000000006DE000.00000002.00000001.01000000.00000016.sdmp, saBSI.exe, 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://sadownload.mcafee.com/products/SA/BSI/bsi_PartnerDistribution.xml/saBSI.exe, 0000000A.00000003.2730262487.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2401223602.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720973329.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002F1E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2884883686.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2720589934.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2730852804.0000000002F20000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2721125963.0000000002F1F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002F1E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://viruslab-samples.sb.avast.comavg_antivirus_free_online_setup.exe, 0000000C.00000003.2577221124.0000000005DA0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://www.bitcomet.com/doc/privacy-policy.phpSecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.000000000085C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2642171583.00000000074E9000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2622264821.0000000002390000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1703819395.0000000003490000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://analytics.apis.mcafee.com/saBSI.exe, 0000000A.00000003.2895072615.0000000002EB9000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2373312406.0000000002EE3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://sadownload.mcafee.com/products/SA/v1/bsisaBSI.exe, 0000000A.00000003.2884586261.0000000005405000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2894779605.0000000005408000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2731341920.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2729383650.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2486584163.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2884328927.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2718431117.0000000005404000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://www.bitcomet.com/client/install-stats/?l=en_us&file=BitComet_2.08a_setup.exe&p=x64.BitComet_stats.exe, 00000008.00000003.2228323587.00000000006CF000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000003.2228442765.00000000006CF000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000002.2230297660.00000000006CF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://www.bitcomet.com/client/install-stats/?l=en_us&file=BitComet_2.08a_setup.exe&p=x64(BitComet_stats.exe, 00000008.00000002.2230476280.000000000070C000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000003.2228162848.000000000070C000.00000004.00000020.00020000.00000000.sdmp, BitComet_stats.exe, 00000008.00000003.2227044278.000000000070C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://sadownload.mcafee.com/products/SA/BSI/bsi_vars.xsaBSI.exe, 0000000A.00000003.2401223602.0000000002F04000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000002.2897708570.0000000002EE3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2896027780.0000000002EE3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2728067926.0000000002EE3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2719167639.0000000002EE3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://d11iilsblp9z11.cloudfront.net/f/AVG_AV/images/1509/EN.pngI.zipSecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.000000000085C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://sadownload.mcafee.com/products/sa/bsi/win/binarysaBSI.exe, 0000000A.00000003.2884586261.0000000005405000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2894779605.0000000005408000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2731341920.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2729383650.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2486584163.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2884328927.0000000005404000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 0000000A.00000003.2718431117.0000000005404000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://www.winzip.com/win/en/eula.htmlSecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2110428676.0000000000818000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.2410033411.0000000000818000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760509842.000000000085F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1778301135.0000000000818000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760569997.0000000000815000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000002.2618744694.000000000081A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            http://v7event.stats.avast.com:80/cgi-bin/iavsevents.cgiavg_antivirus_free_setup.exe, 0000000B.00000003.2391365686.0000000004E30000.00000004.00000020.00020000.00000000.sdmp, avg_antivirus_free_setup.exe, 0000000B.00000002.2976222461.0000000004E30000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://home.mcafee.com/Root/AboutUs.aspx?iuSecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1760509842.000000000085F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp, 00000001.00000003.1778301135.0000000000861000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown

                                                                            World Map of Contacted IPs

                                                                            • No. of IPs < 25%
                                                                            • 25% < No. of IPs < 50%
                                                                            • 50% < No. of IPs < 75%
                                                                            • 75% < No. of IPs

                                                                            Public IPs

                                                                            IPDomainCountryFlagASNASN NameMalicious
                                                                            161.97.135.85
                                                                            		inside.bitcomet.comUnited States
                                                                            		51167CONTABODEfalse
                                                                            52.25.171.187
                                                                            		mosaic-orio.apis.mcafee.comUnited States
                                                                            		16509AMAZON-02USfalse
                                                                            13.249.12.125
                                                                            		d11iilsblp9z11.cloudfront.netUnited States
                                                                            		16509AMAZON-02USfalse
                                                                            162.159.61.3
                                                                            		unknownUnited States
                                                                            		13335CLOUDFLARENETUSfalse
                                                                            146.12.137.105
                                                                            		unknownUnited States
                                                                            		197938TRAVIANGAMESDEfalse
                                                                            87.98.162.88
                                                                            		dht.transmissionbt.comFrance
                                                                            		16276OVHFRfalse
                                                                            172.64.41.3
                                                                            		chrome.cloudflare-dns.comUnited States
                                                                            		13335CLOUDFLARENETUSfalse
                                                                            143.204.205.88
                                                                            		unknownUnited States
                                                                            		16509AMAZON-02USfalse
                                                                            34.160.176.28
                                                                            		shepherd-gcp.ff.avast.comUnited States
                                                                            		2686ATGS-MMD-ASUSfalse
                                                                            34.117.223.223
                                                                            		analytics-prod-gcp.ff.avast.comUnited States
                                                                            		139070GOOGLE-AS-APGoogleAsiaPacificPteLtdSGfalse
                                                                            172.183.192.109
                                                                            		unknownUnited States
                                                                            		7018ATT-INTERNET4USfalse
                                                                            161.97.134.106
                                                                            		unknownUnited States
                                                                            		51167CONTABODEfalse
                                                                            239.255.255.250
                                                                            		unknownReserved
                                                                            		unknownunknownfalse
                                                                            95.111.225.211
                                                                            		apphit.comUkraine
                                                                            		51167CONTABODEfalse
                                                                            142.250.65.200
                                                                            		unknownUnited States
                                                                            		15169GOOGLEUSfalse

                                                                            Private

                                                                            IP
                                                                            127.0.0.1

                                                                            General Information

                                                                            Joe Sandbox version:40.0.0 Tourmaline
                                                                            Analysis ID:1476246
                                                                            Start date and time:2024-07-18 21:37:06 +02:00
                                                                            Joe Sandbox product:CloudBasic
                                                                            Overall analysis duration:0h 13m 16s
                                                                            Hypervisor based Inspection enabled:false
                                                                            Report type:full
                                                                            Cookbook file name:default.jbs
                                                                            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                            Number of analysed new started processes analysed:45
                                                                            Number of new started drivers analysed:0
                                                                            Number of existing processes analysed:0
                                                                            Number of existing drivers analysed:0
                                                                            Number of injected processes analysed:0
                                                                            Technologies:
                                                                            • HCA enabled
                                                                            • EGA enabled
                                                                            • AMSI enabled
                                                                            Analysis Mode:default
                                                                            Analysis stop reason:Timeout
                                                                            Sample name:SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe
                                                                            Detection:MAL
                                                                            Classification:mal46.rans.troj.evad.winEXE@65/491@81/16
                                                                            EGA Information:
                                                                            • Successful, ratio: 71.4%
                                                                            HCA Information:
                                                                            • Successful, ratio: 91%
                                                                            • Number of executed functions: 189
                                                                            • Number of non-executed functions: 177
                                                                            Cookbook Comments:
                                                                            • Found application associated with file extension: .exe

                                                                            Warnings

                                                                            • Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe
                                                                            • Excluded IPs from analysis (whitelisted): 23.212.89.10, 216.239.36.178, 216.239.38.178, 216.239.34.178, 216.239.32.178, 2.19.126.150, 2.19.126.156, 13.107.42.16, 184.28.90.27, 20.82.9.214, 216.58.206.40, 20.42.73.29, 151.101.2.133, 142.251.35.163, 142.251.40.131
                                                                            • Excluded domains from analysis (whitelisted): nav-edge.smartscreen.microsoft.com, config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, secure.globalsign.com, tm-prod-wd-csp-edge.trafficmanager.net, home.mcafee.com, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.googletagmanager.com, e16604.g.akamaiedge.net, prod-agic-we-1.westeurope.cloudapp.azure.com, onedsblobprdeus15.eastus.cloudapp.azure.com, www.gstatic.com, l-0007.l-msedge.net, prod.fs.microsoft.com.akadns.net, config.edge.skype.com, www.google-analytics.com, fs.microsoft.com, e9229.dscd.akamaiedge.net, s-honzik.avcdn.net.edgekey.net, a866.dscd.akamai.net, www-alv.google-analytics.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com, global.prd.cdn.globalsign.com, l-0007.config.skype.com, sadownload.mcafee.com.edgesuite.net, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microso
                                                                            • Execution Graph export aborted for target BitCometService.exe, PID 5824 because there are no executed function
                                                                            • Not all processes where analyzed, report is missing behavior information
                                                                            • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                            • Report size exceeded maximum capacity and may have missing behavior information.
                                                                            • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                            • Report size exceeded maximum capacity and may have missing network information.
                                                                            • Report size getting too big, too many NtDeviceIoControlFile calls found.
                                                                            • Report size getting too big, too many NtEnumerateKey calls found.
                                                                            • Report size getting too big, too many NtOpenFile calls found.
                                                                            • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                            • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                            • Report size getting too big, too many NtQueryValueKey calls found.
                                                                            • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                            • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                            • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                            • VT rate limit hit for: SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe

                                                                            Simulations

                                                                            Behavior and APIs

                                                                            TimeTypeDescription
                                                                            15:38:06API Interceptor7x Sleep call for process: SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp modified
                                                                            15:38:53API Interceptor1x Sleep call for process: BitComet_stats.exe modified
                                                                            15:39:09API Interceptor2x Sleep call for process: avg_antivirus_free_setup.exe modified
                                                                            15:39:12API Interceptor8x Sleep call for process: avg_antivirus_free_online_setup.exe modified
                                                                            15:39:16API Interceptor2x Sleep call for process: svchost.exe modified
                                                                            15:39:17API Interceptor2x Sleep call for process: BitComet.exe modified
                                                                            15:39:27API Interceptor2x Sleep call for process: WerFault.exe modified
                                                                            15:40:00API Interceptor1x Sleep call for process: saBSI.exe modified

                                                                            Joe Sandbox View / Context

                                                                            IPs

                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                            161.97.135.85SecuriteInfo.com.Trojan.InstallCore.4086.24549.19610.exeGet hashmaliciousPrivateLoader, PureLog StealerBrowse
                                                                              SecuriteInfo.com.Trojan.InstallCore.4086.24549.19610.exeGet hashmaliciousPrivateLoader, PureLog StealerBrowse
                                                                                162.159.61.3EMPLOYEE APPRAISAL REVIEW FOR breen.loney Q2 2024.pdfGet hashmaliciousHTMLPhisherBrowse
                                                                                  https://app.pandadoc.com/document/01fc0506672a338844b1e0a33f8f8c691e8b5536Get hashmaliciousUnknownBrowse
                                                                                    Scanner_SKME092878673568739809289728639802765768729809208.pdfGet hashmaliciousUnknownBrowse
                                                                                      MicrosoftInst.exeGet hashmaliciousGhostRatBrowse
                                                                                        PEDIDO DE COMPRA URGENTEs#U034fx#U034fl#U034fx#U034f..exeGet hashmaliciousFormBookBrowse
                                                                                          PO.pdfGet hashmaliciousUnknownBrowse
                                                                                            CC-CREDIT CARD-itineraries.exeGet hashmaliciousFormBookBrowse
                                                                                              s6ue6dcFAI.exeGet hashmaliciousBabadedaBrowse
                                                                                                JblYqEneyY.exeGet hashmaliciousBabadedaBrowse
                                                                                                  s6ue6dcFAI.exeGet hashmaliciousBabadedaBrowse
                                                                                                    172.64.41.3https://app.pandadoc.com/document/01fc0506672a338844b1e0a33f8f8c691e8b5536Get hashmaliciousUnknownBrowse
                                                                                                      downloadGet hashmaliciousUnknownBrowse
                                                                                                        Scanner_SKME092878673568739809289728639802765768729809208.pdfGet hashmaliciousUnknownBrowse
                                                                                                          Please_Docusign_this_document_July 2024_2471.pdfGet hashmaliciousUnknownBrowse
                                                                                                            SecuriteInfo.com.decompression.bomb.9781.1949.exeGet hashmaliciousUnknownBrowse
                                                                                                              p_view_20241106.pdfGet hashmaliciousUnknownBrowse
                                                                                                                cc00980_.exeGet hashmaliciousUnknownBrowse
                                                                                                                  ziprar.exeGet hashmaliciousUnknownBrowse
                                                                                                                    https://spacesolutions1-my.sharepoint.com/:f:/g/personal/sophie_mcnally_spacesolutions_co_uk/EkJ_RlaL8JdMhn3SJdI6Xr8BfXrsiWDMQbMc_A0Yc908bw?e=YFS2VSGet hashmaliciousUnknownBrowse
                                                                                                                      PEDIDO DE COMPRA URGENTEs#U034fx#U034fl#U034fx#U034f..exeGet hashmaliciousFormBookBrowse
                                                                                                                        34.160.176.28winrar-64-6.21-installer_AmGAP-1.exeGet hashmaliciousPureLog StealerBrowse
                                                                                                                          ccsetup624.exeGet hashmaliciousUnknownBrowse
                                                                                                                            806aab44-6c03-4577-a3c4-83aa13dc7875.tmpGet hashmaliciousUnknownBrowse
                                                                                                                              Microstub.exeGet hashmaliciousUnknownBrowse
                                                                                                                                Microstub.exeGet hashmaliciousUnknownBrowse
                                                                                                                                  ccsetup621.zipGet hashmaliciousUnknownBrowse
                                                                                                                                    https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclientGet hashmaliciousUnknownBrowse
                                                                                                                                      http://www.poweriso-mirror.com/PowerISO8.exeGet hashmaliciousUnknownBrowse
                                                                                                                                        _.exeGet hashmaliciousUnknownBrowse
                                                                                                                                          _.exeGet hashmaliciousUnknownBrowse

                                                                                                                                            Domains

                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                            shepherd-gcp.ff.avast.comccsetup624.exeGet hashmaliciousUnknownBrowse
                                                                                                                                            • 34.160.176.28
                                                                                                                                            806aab44-6c03-4577-a3c4-83aa13dc7875.tmpGet hashmaliciousUnknownBrowse
                                                                                                                                            • 34.160.176.28
                                                                                                                                            Microstub.exeGet hashmaliciousUnknownBrowse
                                                                                                                                            • 34.160.176.28
                                                                                                                                            Microstub.exeGet hashmaliciousUnknownBrowse
                                                                                                                                            • 34.160.176.28
                                                                                                                                            ccsetup621.zipGet hashmaliciousUnknownBrowse
                                                                                                                                            • 34.160.176.28
                                                                                                                                            https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclientGet hashmaliciousUnknownBrowse
                                                                                                                                            • 34.160.176.28
                                                                                                                                            http://www.poweriso-mirror.com/PowerISO8.exeGet hashmaliciousUnknownBrowse
                                                                                                                                            • 34.160.176.28
                                                                                                                                            _.exeGet hashmaliciousUnknownBrowse
                                                                                                                                            • 34.160.176.28
                                                                                                                                            _.exeGet hashmaliciousUnknownBrowse
                                                                                                                                            • 34.160.176.28
                                                                                                                                            CCleaner.exeGet hashmaliciousRMSRemoteAdmin, Remote UtilitiesBrowse
                                                                                                                                            • 34.160.176.28
                                                                                                                                            mosaic-orio.apis.mcafee.comhttps://www.poweriso.net/PowerISO8-x64.exeGet hashmaliciousUnknownBrowse
                                                                                                                                            • 52.26.85.137
                                                                                                                                            dht.transmissionbt.com5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.zipGet hashmaliciousXmrigBrowse
                                                                                                                                            • 87.98.162.88
                                                                                                                                            240506-b7lv1sfmcw_pw_infected.zipGet hashmaliciousXmrigBrowse
                                                                                                                                            • 87.98.162.88
                                                                                                                                            240506-b7lv1sfmcw_pw_infected.zipGet hashmaliciousXmrigBrowse
                                                                                                                                            • 87.98.162.88
                                                                                                                                            5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.zipGet hashmaliciousXmrigBrowse
                                                                                                                                            • 87.98.162.88
                                                                                                                                            na.elfGet hashmaliciousMiraiBrowse
                                                                                                                                            • 87.98.162.88
                                                                                                                                            Photo.scr.exeGet hashmaliciousXmrigBrowse
                                                                                                                                            • 87.98.162.88
                                                                                                                                            bin.shGet hashmaliciousMiraiBrowse
                                                                                                                                            • 212.129.33.59
                                                                                                                                            bin.shGet hashmaliciousMiraiBrowse
                                                                                                                                            • 212.129.33.59
                                                                                                                                            AV.scrGet hashmaliciousXmrigBrowse
                                                                                                                                            • 212.129.33.59
                                                                                                                                            Photo.scrGet hashmaliciousXmrigBrowse
                                                                                                                                            • 87.98.162.88
                                                                                                                                            chrome.cloudflare-dns.comhttps://app.pandadoc.com/document/01fc0506672a338844b1e0a33f8f8c691e8b5536Get hashmaliciousUnknownBrowse
                                                                                                                                            • 172.64.41.3
                                                                                                                                            SecuriteInfo.com.decompression.bomb.9781.1949.exeGet hashmaliciousUnknownBrowse
                                                                                                                                            • 172.64.41.3
                                                                                                                                            MicrosoftInst.exeGet hashmaliciousGhostRatBrowse
                                                                                                                                            • 162.159.61.3
                                                                                                                                            cc00980_.exeGet hashmaliciousUnknownBrowse
                                                                                                                                            • 172.64.41.3
                                                                                                                                            ziprar.exeGet hashmaliciousUnknownBrowse
                                                                                                                                            • 172.64.41.3
                                                                                                                                            PEDIDO DE COMPRA URGENTEs#U034fx#U034fl#U034fx#U034f..exeGet hashmaliciousFormBookBrowse
                                                                                                                                            • 172.64.41.3
                                                                                                                                            https://ury.io/aVPeBaGet hashmaliciousUnknownBrowse
                                                                                                                                            • 172.64.41.3
                                                                                                                                            CC-CREDIT CARD-itineraries.exeGet hashmaliciousFormBookBrowse
                                                                                                                                            • 162.159.61.3
                                                                                                                                            bt2eTjYGOb.exeGet hashmaliciousUnknownBrowse
                                                                                                                                            • 172.64.41.3
                                                                                                                                            s6ue6dcFAI.exeGet hashmaliciousBabadedaBrowse
                                                                                                                                            • 162.159.61.3

                                                                                                                                            ASNs

                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                            CONTABODEhttp://zerosevenone.buzz/Get hashmaliciousUnknownBrowse
                                                                                                                                            • 161.97.83.26
                                                                                                                                            DOC -For-Rockwool.pdfGet hashmaliciousUnknownBrowse
                                                                                                                                            • 173.249.54.85
                                                                                                                                            mlk3kK6uLZ.exeGet hashmaliciousAmadey, Mars Stealer, PureLog Stealer, Quasar, RedLine, Stealc, VidarBrowse
                                                                                                                                            • 213.136.93.115
                                                                                                                                            https://sites.google.com/view/mposecsrfbjgplrkjzznxxrhdjmqmp/accueilGet hashmaliciousUnknownBrowse
                                                                                                                                            • 178.238.224.248
                                                                                                                                            1720591325f5478047ee3721bf0b0649bb42cc34e9e6a69a5014cf6e24bdb38eff5f9aa4a6227.dat-decoded.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                            • 161.97.124.96
                                                                                                                                            Request for Quotation.vbsGet hashmaliciousAgentTeslaBrowse
                                                                                                                                            • 161.97.124.96
                                                                                                                                            XX(1).exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                                                                                                            • 164.68.127.9
                                                                                                                                            McrflHf6vg.exeGet hashmaliciousWhiteSnake StealerBrowse
                                                                                                                                            • 167.86.115.218
                                                                                                                                            rnoahcrypter.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                                                                                                            • 164.68.127.9
                                                                                                                                            https://link.mail.beehiiv.com/ls/click?upn=u001.DTQiLe1mLQCNek4IXPrb3VfkDRZqOjfShPTiZjGkXYeHH0qcNkYwSSCzibjlmAzeTFQugAGktmmDcLaGVd7xmrhViuDlzvk7LSYra0CxW0GfjPradQJiCp1Lv1-2BJr8tU4uPUlMdZtOopAucgMUwgTsNkjDwJaQiHNbOIjuz9-2F3lablcjJiJu79900Z-2B-2BB-2F6jXyiW_VW5ZEdFpCuXmC2nf4fwMfiBmdui0O95PSMmp4s-2F2oS3jvSHISWr6XQl8RtHpD7TWmHpRBlT8NsCamUZaroeFibjayeskXeuNnFhPFOon1-2FD6SmbcpIEUC7jghzzXsggajKIODB16RJEeGNz4SFHe6mT-2Bn59v08ju13fD9NtKJQcr97qiQNjiGiaoQJcvN3gUurUBqLZp9I4f9bNW54ZUVVCzpwaogbLaWcL9oScbt8pPuOyTauAJYwyhhj24yBhp7RMjj-2F0GEsPKyiUipvQjkQHl7wMea8EX-2BEwxs5CkLSgKbIS5ztD-2FRjTIduXCBnVT1QnOLd-2FvmyGT6B7reFiJd8Uxm5bV4XvIh0yb5H69DRSKW3EikbmS1X801NApBjBxNojnvbDZeuwCzdsxI3Q5aBPTHO4KAIPr3eArcRNMGEhsEzfjMMKf-2F6jodzrXKEkXK5P-2Fd4Xgx-2FJIzg1wpgwJNw-3D-3D#?email=c3BlbmNlci53dW5kZXJsZUBoc2Nwb2x5LmNvbQ==Get hashmaliciousFake Captcha, HTMLPhisherBrowse
                                                                                                                                            • 173.249.54.85
                                                                                                                                            CLOUDFLARENETUSSecuriteInfo.com.Win32.Malware-gen.18751.23755.exeGet hashmaliciousUnknownBrowse
                                                                                                                                            • 172.67.201.212
                                                                                                                                            https://t.infomail.microsoft.com/r/?id=h707ecfa5,69ca6c1c,69ccacb0&e=b2NpZD1jbW1hbmlleDN4Mg&s=TT2m-Y1733ga9dYQbmzwO7CS0-MhXWa3NfkkfpZX75EGet hashmaliciousUnknownBrowse
                                                                                                                                            • 104.18.36.155
                                                                                                                                            Company Profile.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                                                                            • 104.21.67.152
                                                                                                                                            https://a.kerika.com/acc_39TXETMEnauTtVtsNzbfFJ/c/brd_4nvvo2ooyq8HxjaMzCxzZb/cnvs_BfJOZGet hashmaliciousTycoon2FABrowse
                                                                                                                                            • 188.114.96.3
                                                                                                                                            https://a.kerika.com/acc_39TXETMEnauTtVtsNzbfFJ/c/brd_4nvvo2ooyq8HxjaMzCxzZb/cnvs_BfJOZGet hashmaliciousTycoon2FABrowse
                                                                                                                                            • 188.114.96.3
                                                                                                                                            SecuriteInfo.com.Trojan.MSIL.Crypt.8674.14789.exeGet hashmaliciousUnknownBrowse
                                                                                                                                            • 104.21.22.15
                                                                                                                                            SecuriteInfo.com.Trojan.MSIL.Crypt.8674.14789.exeGet hashmaliciousUnknownBrowse
                                                                                                                                            • 104.21.22.15
                                                                                                                                            FAX-0071824-946501.pdfGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                            • 104.21.38.221
                                                                                                                                            https://docs.google.com/presentation/d/e/2PACX-1vSkULgYz3oNIJkLmxFha2VXFuj7oFBDX_AZimtiACquT4m3bu8bMhm0Wd4nxGWbpyIsGaRcHqolMDfU/pub?start=false&loop=false&delayms=3000Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                            • 104.17.25.14
                                                                                                                                            https://confirmcloudshare.top/k0I4DhdCrw#Ryano*@Vib.comGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                            • 104.21.31.239
                                                                                                                                            AMAZON-02USjklarmGet hashmaliciousUnknownBrowse
                                                                                                                                            • 44.231.219.156
                                                                                                                                            https://t.infomail.microsoft.com/r/?id=h707ecfa5,69ca6c1c,69ccacb0&e=b2NpZD1jbW1hbmlleDN4Mg&s=TT2m-Y1733ga9dYQbmzwO7CS0-MhXWa3NfkkfpZX75EGet hashmaliciousUnknownBrowse
                                                                                                                                            • 18.200.174.228
                                                                                                                                            https://a.kerika.com/acc_39TXETMEnauTtVtsNzbfFJ/c/brd_4nvvo2ooyq8HxjaMzCxzZb/cnvs_BfJOZGet hashmaliciousTycoon2FABrowse
                                                                                                                                            • 52.219.95.2
                                                                                                                                            https://a.kerika.com/acc_39TXETMEnauTtVtsNzbfFJ/c/brd_4nvvo2ooyq8HxjaMzCxzZb/cnvs_BfJOZGet hashmaliciousTycoon2FABrowse
                                                                                                                                            • 18.239.36.25
                                                                                                                                            file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                            • 143.204.215.115
                                                                                                                                            https://docs.google.com/presentation/d/e/2PACX-1vSkULgYz3oNIJkLmxFha2VXFuj7oFBDX_AZimtiACquT4m3bu8bMhm0Wd4nxGWbpyIsGaRcHqolMDfU/pub?start=false&loop=false&delayms=3000Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                            • 52.219.111.40
                                                                                                                                            https://confirmcloudshare.top/k0I4DhdCrw#Ryano*@Vib.comGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                            • 18.239.36.120
                                                                                                                                            https://yourorganization-fgctr.formstack.com/forms/hr_departmentGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                            • 18.239.50.103
                                                                                                                                            file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                            • 13.32.110.25
                                                                                                                                            file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                            • 143.204.215.122
                                                                                                                                            AMAZON-02USjklarmGet hashmaliciousUnknownBrowse
                                                                                                                                            • 44.231.219.156
                                                                                                                                            https://t.infomail.microsoft.com/r/?id=h707ecfa5,69ca6c1c,69ccacb0&e=b2NpZD1jbW1hbmlleDN4Mg&s=TT2m-Y1733ga9dYQbmzwO7CS0-MhXWa3NfkkfpZX75EGet hashmaliciousUnknownBrowse
                                                                                                                                            • 18.200.174.228
                                                                                                                                            https://a.kerika.com/acc_39TXETMEnauTtVtsNzbfFJ/c/brd_4nvvo2ooyq8HxjaMzCxzZb/cnvs_BfJOZGet hashmaliciousTycoon2FABrowse
                                                                                                                                            • 52.219.95.2
                                                                                                                                            https://a.kerika.com/acc_39TXETMEnauTtVtsNzbfFJ/c/brd_4nvvo2ooyq8HxjaMzCxzZb/cnvs_BfJOZGet hashmaliciousTycoon2FABrowse
                                                                                                                                            • 18.239.36.25
                                                                                                                                            file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                            • 143.204.215.115
                                                                                                                                            https://docs.google.com/presentation/d/e/2PACX-1vSkULgYz3oNIJkLmxFha2VXFuj7oFBDX_AZimtiACquT4m3bu8bMhm0Wd4nxGWbpyIsGaRcHqolMDfU/pub?start=false&loop=false&delayms=3000Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                            • 52.219.111.40
                                                                                                                                            https://confirmcloudshare.top/k0I4DhdCrw#Ryano*@Vib.comGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                            • 18.239.36.120
                                                                                                                                            https://yourorganization-fgctr.formstack.com/forms/hr_departmentGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                            • 18.239.50.103
                                                                                                                                            file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                            • 13.32.110.25
                                                                                                                                            file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                            • 143.204.215.122

                                                                                                                                            JA3 Fingerprints

                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                            74954a0c86284d0d6e1c4efefe92b521SecuriteInfo.com.W32.Kryptik.CI.tr.21358.1519.exeGet hashmaliciousUnknownBrowse
                                                                                                                                            • 34.117.223.223
                                                                                                                                            • 34.160.176.28
                                                                                                                                            golang-modules.exeGet hashmaliciousUnknownBrowse
                                                                                                                                            • 34.117.223.223
                                                                                                                                            • 34.160.176.28
                                                                                                                                            SecuriteInfo.com.Trojan.Win64.Agent.14415.19839.exeGet hashmaliciousUnknownBrowse
                                                                                                                                            • 34.117.223.223
                                                                                                                                            • 34.160.176.28
                                                                                                                                            Letter-04.docGet hashmaliciousUnknownBrowse
                                                                                                                                            • 34.117.223.223
                                                                                                                                            • 34.160.176.28
                                                                                                                                            chromeUpdate.exeGet hashmaliciousUnknownBrowse
                                                                                                                                            • 34.117.223.223
                                                                                                                                            • 34.160.176.28
                                                                                                                                            PRE-PCM DMD VSAT 2024-25 OF BAF Sta SNR.docGet hashmaliciousUnknownBrowse
                                                                                                                                            • 34.117.223.223
                                                                                                                                            • 34.160.176.28
                                                                                                                                            TS-240617-UF1.exeGet hashmaliciousPython Stealer, Creal StealerBrowse
                                                                                                                                            • 34.117.223.223
                                                                                                                                            • 34.160.176.28
                                                                                                                                            TS-240609-CStealer1.exeGet hashmaliciousPython Stealer, Creal StealerBrowse
                                                                                                                                            • 34.117.223.223
                                                                                                                                            • 34.160.176.28
                                                                                                                                            build.htaGet hashmaliciousQuasarBrowse
                                                                                                                                            • 34.117.223.223
                                                                                                                                            • 34.160.176.28
                                                                                                                                            ZK9XFb424l.exeGet hashmaliciousPython Stealer, Creal Stealer, XWormBrowse
                                                                                                                                            • 34.117.223.223
                                                                                                                                            • 34.160.176.28
                                                                                                                                            a0e9f5d64349fb13191bc781f81f42e1Enquiry.exeGet hashmaliciousRemcos, DBatLoaderBrowse
                                                                                                                                            • 143.204.205.88
                                                                                                                                            • 34.117.223.223
                                                                                                                                            • 52.25.171.187
                                                                                                                                            • 13.249.12.125
                                                                                                                                            3YFh1o2TfZ.xlsxGet hashmaliciousUnknownBrowse
                                                                                                                                            • 143.204.205.88
                                                                                                                                            • 34.117.223.223
                                                                                                                                            • 52.25.171.187
                                                                                                                                            • 13.249.12.125
                                                                                                                                            JtEm7XoJt4.exeGet hashmaliciousLummaC, VidarBrowse
                                                                                                                                            • 143.204.205.88
                                                                                                                                            • 34.117.223.223
                                                                                                                                            • 52.25.171.187
                                                                                                                                            • 13.249.12.125
                                                                                                                                            zheidzzyHi.exeGet hashmaliciousLummaCBrowse
                                                                                                                                            • 143.204.205.88
                                                                                                                                            • 34.117.223.223
                                                                                                                                            • 52.25.171.187
                                                                                                                                            • 13.249.12.125
                                                                                                                                            SapphireX.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                            • 143.204.205.88
                                                                                                                                            • 34.117.223.223
                                                                                                                                            • 52.25.171.187
                                                                                                                                            • 13.249.12.125
                                                                                                                                            SapphireX.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                            • 143.204.205.88
                                                                                                                                            • 34.117.223.223
                                                                                                                                            • 52.25.171.187
                                                                                                                                            • 13.249.12.125
                                                                                                                                            Trialog_Drives_Mapping.xlsxGet hashmaliciousUnknownBrowse
                                                                                                                                            • 143.204.205.88
                                                                                                                                            • 34.117.223.223
                                                                                                                                            • 52.25.171.187
                                                                                                                                            • 13.249.12.125
                                                                                                                                            #U7535#U8111#U98de#U673a&7.exeGet hashmaliciousUnknownBrowse
                                                                                                                                            • 143.204.205.88
                                                                                                                                            • 34.117.223.223
                                                                                                                                            • 52.25.171.187
                                                                                                                                            • 13.249.12.125
                                                                                                                                            #U7535#U8111#U98de#U673a&7.exeGet hashmaliciousUnknownBrowse
                                                                                                                                            • 143.204.205.88
                                                                                                                                            • 34.117.223.223
                                                                                                                                            • 52.25.171.187
                                                                                                                                            • 13.249.12.125
                                                                                                                                            Tesst_1.exeGet hashmaliciousUnknownBrowse
                                                                                                                                            • 143.204.205.88
                                                                                                                                            • 34.117.223.223
                                                                                                                                            • 52.25.171.187
                                                                                                                                            • 13.249.12.125

                                                                                                                                            Dropped Files

                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                            C:\Program Files\BitComet\WebView2Loader.dllSecuriteInfo.com.Trojan.InstallCore.4086.24549.19610.exeGet hashmaliciousPrivateLoader, PureLog StealerBrowse
                                                                                                                                              SecuriteInfo.com.Trojan.InstallCore.4086.24549.19610.exeGet hashmaliciousPrivateLoader, PureLog StealerBrowse
                                                                                                                                                SecuriteInfo.com.Trojan.InstallCore.4086.15026.2213.exeGet hashmaliciousPrivateLoader, PureLog StealerBrowse
                                                                                                                                                  SecuriteInfo.com.Trojan.InstallCore.4086.15026.2213.exeGet hashmaliciousPrivateLoader, PureLog StealerBrowse
                                                                                                                                                    jTCGq3zaZi.crxGet hashmaliciousUnknownBrowse
                                                                                                                                                      C:\Program Files\BitComet\CrashReport.exeSecuriteInfo.com.Trojan.InstallCore.4086.24549.19610.exeGet hashmaliciousPrivateLoader, PureLog StealerBrowse
                                                                                                                                                        SecuriteInfo.com.Trojan.InstallCore.4086.24549.19610.exeGet hashmaliciousPrivateLoader, PureLog StealerBrowse
                                                                                                                                                          SecuriteInfo.com.Trojan.InstallCore.4086.15026.2213.exeGet hashmaliciousPrivateLoader, PureLog StealerBrowse
                                                                                                                                                            SecuriteInfo.com.Trojan.InstallCore.4086.15026.2213.exeGet hashmaliciousPrivateLoader, PureLog StealerBrowse

                                                                                                                                                              Created / dropped Files

                                                                                                                                                              C:\Program Files\BitComet\BitComet.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):27838352
                                                                                                                                                              Entropy (8bit):6.591624431541829
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:393216:RmdPJ4LX3qBudzY+ttl0vgylC/iSSL6QbonoR9YrWJM6WZdCw:RmdPuLqsVTECKSeUnu9b6p7
                                                                                                                                                              MD5:BFDFE1495ADA381F3D57C6E6DF04E189
                                                                                                                                                              SHA1:BD1080D262FC7B6C5C86C4516CEBCAE7B84AC9C5
                                                                                                                                                              SHA-256:CEAA1ECB0C6D7DDE6226C18291FACD39E3FE0A0D7B020CD5BFE9D2935A9FA468
                                                                                                                                                              SHA-512:68D48656B8A0EAB603FB2916C6FA9CD817F2994820D340C97B6C494DE110D47A75773AA29C70136861EE648EA0670B2359D2A474960D173C4C5576B2EE9CB6CC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                                                              Preview:MZ......................@...................................x...........!..L.!This program cannot be run in DOS mode....$.........V~.i8-.i8-.i8-..=,.i8-.i8-.i8-(.<,.k8-9..-.i8-9..-^i8-9..-.i8-..<,.i8-(.;,.i8-..=,.i8-...-.i8-..;,.i8-(.=,.i8-%.<,.i8-%.=,*h8-..=,.i8-..<,.i8-...-.i8-...-.i8-...-.i8-...-.i8-.i9-.j8-&.1,Yk8-&..-.i8-.i.-.i8-&.:,.i8-Rich.i8-........................PE..d.....f..........".................<&.........@.....................................g....`.................................................@Um......`...K#.....dX.......'......TY..P,;.T....................-;.(....,;..............................................text...X........................... ..`.rdata....u.......u.................@..@.data.........m.......m.............@....pdata...X.......Z...zu.............@..@.detourc."... ...$..................@..@.detourd.....P......................@....rsrc....K#..`...L#.................@..@.reloc..TY.......Z...F..............@..B........................................

                                                                                                                                                              C:\Program Files\BitComet\BitComet.url

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:MS Windows 95 Internet shortcut text (URL=<http://www.bitcomet.com/>), ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):50
                                                                                                                                                              Entropy (8bit):4.4083674395583765
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:HRAbABGQYm/0S4swgCn:HRYFVm/r4sVCn
                                                                                                                                                              MD5:DB92ACDD3CA34962A98787EF93BA720D
                                                                                                                                                              SHA1:C1E35D6B82C767652361AA023892314F951FA7F2
                                                                                                                                                              SHA-256:9C62EE59333568C5248CB620435BA08BBB2FAF79D08BFD0569B7E66BCF1E62B2
                                                                                                                                                              SHA-512:9A037D8C0DA68F64841DD2289F24A5179B2FC0F150B0151C5CF9CB924CFA6AE5077E83704B46EAA07C1E5F629B3B5C12D20D35A746DB2E0A0614FD818370968A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:[InternetShortcut]..URL=http://www.bitcomet.com/..

                                                                                                                                                              C:\Program Files\BitComet\ChangeLog.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:Nim source code, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):239867
                                                                                                                                                              Entropy (8bit):4.672999188539498
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6144:3SJVSo8SDNkTj2Jc+lE/d0R/tn1rI1tjXp7XUvepkrFOtYXoXwwlsgrQNEHF2:o9Zu2Jc+lE/d0R/tn1rI1tjXp7XUvep0
                                                                                                                                                              MD5:EA133CFC1CB3B9737BADAEE654E1ACFC
                                                                                                                                                              SHA1:044A8001C9AFE2C07F7C490636FE9F0C0F8B114E
                                                                                                                                                              SHA-256:11A0A321B75C62654A748DB8EBBF5CB97CE1BADE6A6725442C3694980151CC02
                                                                                                                                                              SHA-512:D1945097AB022AEF36B4FCE535361541DA2DF3DA8F5F0552CFDF8C19584055B9870920C7C29FA8C820381F78C7481D7F1F23474677F1B3528E594EBE005F9063
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.changelog..=============================..v2.08 2024.5.30.. GUI Improved: Add SHA512 checksum verification to HTTP task properties dialog.. GUI Improved: Update the IP2Location data version. The data version is displayed in the global log in Expert mode.. GUI Improved: Supplement country/regional flags to the peer list.. GUI Improved: Display the name of IP location in peer list.. GUI Improve: New advanced option: bittorrent.anti_leech_banned_client_names, ban peers by client name.. GUI Bugfix: If the window is set to be minimized at startup, but maximized when the program last exited, the favorites sidebar size is not restored gracefully.. GUI Bugfix: The program crashes when the number of rows in the task log list reaches the limit.. GUI Bugfix: When adding task by clipboard monitoring, task should not be added directly in silent mode.. GUI Bugfix: torrent maker dialog issue in dark mode.. Core Bugfix: Improved compatibility for parsing hybrid torr

                                                                                                                                                              C:\Program Files\BitComet\CrashReport.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1949936
                                                                                                                                                              Entropy (8bit):6.535711188253392
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:49152:0pRX0/HOKZZ8kwyyE/368yyy/S6XxDzb493jj1TLiiI:q8dZHqSGU93Jo
                                                                                                                                                              MD5:AF3A99EFDD6A70F8418431B2DD5DAF10
                                                                                                                                                              SHA1:D43721F53A5D62A7AEA22979ABE41A97576E33D0
                                                                                                                                                              SHA-256:019C73A89EAF7C0D5A5817F2ACBB3A7556EF08E1C5A465A739701FFB617435EF
                                                                                                                                                              SHA-512:3CA7284B0122D58ADBED7C69DC6E842F2D26CD409453D1910D75D73C38464719FCC04BB5B624D5F69E6E93E3BFF9C5BB5851770EF5C4A1D3D1A6B0586EAF6D13
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Joe Sandbox View:
                                                                                                                                                              • Filename: SecuriteInfo.com.Trojan.InstallCore.4086.24549.19610.exe, Detection: malicious, Browse
                                                                                                                                                              • Filename: SecuriteInfo.com.Trojan.InstallCore.4086.24549.19610.exe, Detection: malicious, Browse
                                                                                                                                                              • Filename: SecuriteInfo.com.Trojan.InstallCore.4086.15026.2213.exe, Detection: malicious, Browse
                                                                                                                                                              • Filename: SecuriteInfo.com.Trojan.InstallCore.4086.15026.2213.exe, Detection: malicious, Browse
                                                                                                                                                              Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$....... .Qd...d...d....#7.m....#5.....#4.t.......e.......h.......r.......V...m.E.e...m.U.{...d.......p.......p...r...p.9.e...d.Q.e...p...e...Richd...........................PE..d...k..Z.........."..........0................@..........................................`.....................................................@....`.......p..d...................`...T.......................(.......................h............................text.............................. ..`.rdata...b.......d..................@..@.data....A... ...$..................@....pdata..d....p......."..............@..@.rsrc........`......................@..@.reloc..............................@..B........................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files\BitComet\License.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:ASCII text, with very long lines (511), with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):3324
                                                                                                                                                              Entropy (8bit):4.428609742230892
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:eaZToQacsNGZNMZ0JiCGS+fBpA6zNHUzOE:/oMN80qhDh0zP
                                                                                                                                                              MD5:F89B3E6B67B0F87DAA225822C9BC752C
                                                                                                                                                              SHA1:2826F2199DCAA3FC60D413B2C0C2F41462E11E99
                                                                                                                                                              SHA-256:A4E351B0C180D29D9CA058111E8ED0606556D59E902F0125B1995FC1CF20612B
                                                                                                                                                              SHA-512:9BB1AD63A1835FFF6B093D0F0737913BDC4C49E316F208E116E48D2923B7632F3114C39EC652AEE479AB00EC507172E6E0236BB15548891F95CF664CC8A2BC4D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:BitComet Software License Agreement....This agreement is a legal agreement between you and BitComet Development Group (BitComet) with respect to the use of the BitComet Software (Software).....By using the Software, you acknowledge that you and such use are bound by and subject to the provisions of this agreement without modifications. If you do not accept these terms of use in their entirety, you may not access or use the Software.....1. The Software is being licensed to you free of charge for your private personal use only. The Software is licensed, not sold. You may use the Software for non-commercial purposes only.....2. You may not use the Software in support of any commercial entity or activity without the express written agreement of BitComet. By way of example, and not as a limitation, charging others to use the Software either directly or indirectly, using the Software to sell any goods or services. ....3. The Software is protected by copyright laws and international copyright

                                                                                                                                                              C:\Program Files\BitComet\ReadMe.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4220
                                                                                                                                                              Entropy (8bit):4.771005720072929
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:nWDUH2/3DJzx7XnG7e/G52trKrAES9Ls8:nWg2/3dzx7Xn4eeMEAESe8
                                                                                                                                                              MD5:C1953606C5D7B5C1469F86F131F45167
                                                                                                                                                              SHA1:0AEB1A988B36FA43230DB2193777629130EFB9DD
                                                                                                                                                              SHA-256:29CF2A2D4136762A256213ACBD1E4418E575CF15C6FBC9BECE81D11C0CA8E4A8
                                                                                                                                                              SHA-512:E11F8A3A48953E0C73D09A0EE3AD54E1A853C16EBE84126F1F17D0E5A5211E0DB01DB7A0612D26374FE989B7E5C40C2C38F7D0C2FCA7341E05DE525F86FAF1D0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.BitComet Readme..--------------------------------------------------..Bitcomet is a p2p file-sharing freeware fully compatible with BitTorrent, designed for the high-speed distribution of 100MB or GB sized files. ..BitComet is a easy-to-use multi-torrent client for Win32 platforms, along with lots of improvements. Support download certain files within torrent, ..disk cache, fast resume, port mapping, speed limits, etc. Small, clean, and fast. No adware or spyware.....Feature..--------------------------------------------------..1. Clean and free, without any adware or spyware. ..2. Completely new core written in C++, stable and fast, very low CPU usage...3. Multiple simultaneous downloads, ability to select download files in one torrent and set file priority. ..4. Ability to limit the upload speed as well as download speed. ..5. Intelligent Connection Optimize, Auto Optimization for different connections, runs well using all default settings. ..6. Intelligent Rate Control, optim

                                                                                                                                                              C:\Program Files\BitComet\WebView2Loader.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):158648
                                                                                                                                                              Entropy (8bit):6.175093839791051
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:R8AhKsY0iHlDhvlUQN2gWNZ6hVThFEtqQbucPqAJwU:usY0+lNv6E2JYEtzbuuV
                                                                                                                                                              MD5:577F05CD683ED0577F6C970EA57129E0
                                                                                                                                                              SHA1:AEDF54A8976F0F8FF5588447C344595E3C468925
                                                                                                                                                              SHA-256:7127F20DAA0A0A74E120AB7423DD1B30C45908F8EE929F0C6CD2312B41C5BDDF
                                                                                                                                                              SHA-512:2D1AEA243938A6A1289CF4EFCD541F28AB370A85EF05ED27B7B6D81CE43CEA671E06A0959994807923B1DFEC3B382EE95BD6F9489B74BBA59239601756082047
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Joe Sandbox View:
                                                                                                                                                              • Filename: SecuriteInfo.com.Trojan.InstallCore.4086.24549.19610.exe, Detection: malicious, Browse
                                                                                                                                                              • Filename: SecuriteInfo.com.Trojan.InstallCore.4086.24549.19610.exe, Detection: malicious, Browse
                                                                                                                                                              • Filename: SecuriteInfo.com.Trojan.InstallCore.4086.15026.2213.exe, Detection: malicious, Browse
                                                                                                                                                              • Filename: SecuriteInfo.com.Trojan.InstallCore.4086.15026.2213.exe, Detection: malicious, Browse
                                                                                                                                                              • Filename: jTCGq3zaZi.crx, Detection: malicious, Browse
                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....c.........." .....B..........`D..............................................g.....`A....................................................(............@.......D...'..........4...T.......................(....a..8.......................`....................text...5A.......B.................. ..`.rdata.......`.......F..............@..@.data........ ......................@....pdata.......@......................@..@.00cfg..(....`......................@..@.gxfg...p....p......................@..@.retplne\................................tls.................0..............@....voltbl.D............2.................._RDATA...............4..............@..@.rsrc................6..............@..@.reloc...............<..............@..B........................................................................................................................................

                                                                                                                                                              C:\Program Files\BitComet\ip2location\ip2location-country-multilingual.csv

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:CSV text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1066757
                                                                                                                                                              Entropy (8bit):5.522410005818297
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:e/fCX49lD05Nn5DjzitNNszLR2AaJ8Vt1MnWgxTsc7rMjnIyGVFxrh:eQnx4zFP
                                                                                                                                                              MD5:BB8223111ACECB2DCED731C3499B2DAE
                                                                                                                                                              SHA1:88E755B64AEBC7F46A08D439B0D732D3CFF8BD71
                                                                                                                                                              SHA-256:4E8D384E91CF8CEE0DAC16861203C423121A25935FBB9074E0FDF2A46E8826B6
                                                                                                                                                              SHA-512:219E01552E5A6F79561E2B99B376613D2813E6AA0357364B3E237EBB02B7FB72A34CA2F7F15954F48E56BBE00DA5FE8A76F66340AE53DA9699EE2E442C616C37
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:"LANG","LANG_NAME","COUNTRY_ALPHA2_CODE","COUNTRY_ALPHA3_CODE","COUNTRY_NUMERIC_CODE","COUNTRY_NAME".."AF","AFRIKAANS","AD","AND","20","Andorra".."AF","AFRIKAANS","AE","ARE","784","Verenigde Arabiese Emirate".."AF","AFRIKAANS","AF","AFG","4","Afganistan".."AF","AFRIKAANS","AG","ATG","28","Antigua en Barbuda".."AF","AFRIKAANS","AI","AIA","660","Anguilla".."AF","AFRIKAANS","AL","ALB","8","Albani.".."AF","AFRIKAANS","AM","ARM","51","Armeni.".."AF","AFRIKAANS","AO","AGO","24","Angola".."AF","AFRIKAANS","AQ","ATA","10","Antarktika".."AF","AFRIKAANS","AR","ARG","32","Argentini.".."AF","AFRIKAANS","AS","ASM","16","Amerikaans Samoa".."AF","AFRIKAANS","AT","AUT","40","Oostenryk".."AF","AFRIKAANS","AU","AUS","36","Australi.".."AF","AFRIKAANS","AW","ABW","533","Aruba".."AF","AFRIKAANS","AX","ALA","248",".land-eilande".."AF","AFRIKAANS","AZ","AZE","31","Aserbeidjan".."AF","AFRIKAANS","BA","BIH","70","Bosni. en Herzegowina".."AF","AFRIKAANS","BB","BRB","52","Barbados".."AF","AFRIKAANS","BD","

                                                                                                                                                              C:\Program Files\BitComet\ip2location\ip2location.bin

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):9661158
                                                                                                                                                              Entropy (8bit):4.613171447638994
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:49152:BNaqqqqqqNRVrcTYgu9oxQbQ0gzDj3/ZpLmhsUgQ8gAGoKkvrRY/ppgd:BNaqqqqqqPiYgLQ8bLmhsUgQvq
                                                                                                                                                              MD5:FA3F09A9991EFBDE179A3BC91F221A91
                                                                                                                                                              SHA1:8A7AD55AAFD39AB9E360DEE7742A25858BB17F72
                                                                                                                                                              SHA-256:4CEC45D6E8AE7D38C5538AD41D03FDA25D3EB094FF856983BD3297317D8BE136
                                                                                                                                                              SHA-512:55A23C22AD1E96FBB7AD3888A752D24680F8DA894E10CE4E5480BC51801445FE938D4D2F066DC52113D105464CE423FEC83BF2805ADA900F76F269273154DCED
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.....'...A...Q...y...A...A......j.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files\BitComet\lang\HowTo-Translate.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4876
                                                                                                                                                              Entropy (8bit):3.976806378598989
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:xEH0b0R60R40Rlg0Rq0Ra0RK0RQ0R90R60R10RH0Res0RB0RR0R50R80Rj0RZa07:2zljXwRrQ1eyf
                                                                                                                                                              MD5:DCDEE7D1FFB80E2728939933A94FDD64
                                                                                                                                                              SHA1:AF11A2CB19DD6D24DD3179B955DBD8805644D12A
                                                                                                                                                              SHA-256:1978838F43DCAC78B9D899A3C5129F04F7238769EF0C2365E1618E4F22E976DA
                                                                                                                                                              SHA-512:79E058CA5D5EF912E6F3C2AD61F3D07BDF9093E0956DB5CEEF47862DFAC844BA4F3B7DF6084033E08B0AA3AAD7E772BA7A7AE96258A92AFF49CF5E4A391C7D69
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:You can help us to translate BitComet into your own language.....1. Please visit http://www.bbcomet.com/projects/bitcomet/ and try to translate on the web.....2. After finish translation, you can download .mo file from the website, and save it to this folder.. to have a try. BitComet will load it after restart.....3. When the next release of BitComet, we will merge your translation into the install package.....Thank you for your support...........Language list supported by BitComet:.... Language -> Language File Name..==================================================..Albanian -> bitcomet-sq.mo..Arabic -> bitcomet-ar.mo..Armenian -> bitcomet-hy.mo..Azeri -> bitcomet-az.mo *** (see note)..Basque -> bitcomet-eu.mo..Bengali -> bitcomet-bn.mo *** (see note)..Bosnian -> bitcomet-bs.mo..Bulgarian

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-ar.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 1619 messages, Project-Id-Version: BitCometGUI '\330\247\331\204\331\205\331\204\331\201 \330\247\331\204\330\260\331\212 \330\252\331\205 \330\252\331\206\330\262\331\212\331\204\331\207 \331\205\331\201\331\202\331\210\330\257.'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):179258
                                                                                                                                                              Entropy (8bit):5.739299449692993
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:WNXNEh4ZajgDqLyXo7KBkJ7ZZ3hcRrF95494IL7RKmByZrkErAcjGYEeIgdBD5of:cZajfT4iga
                                                                                                                                                              MD5:8DC1F284380CE71DFB73937ACEA62C81
                                                                                                                                                              SHA1:E465E5B4FD72DECC40DA8D9EC6F2B2BC706FC80A
                                                                                                                                                              SHA-256:99BB04C9B2478DE1AEA2FA818E46E09ACE42E9B1931B0AF0A7474328D61908C4
                                                                                                                                                              SHA-512:AD2812A1DAE98C4140ECC4B4D821CF06D79B0F351D0407179C6FA0118F7B4413DCA6C8E1D0C6CE4C30D4A6F82865157C6F3DAF55B22A9DEA2080C34CC81E7364
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:........S........2..q...Le..........&...........8...$...M...%...r..."......................=......"...0.......S...'...l...>.......I......".......&...@...7...g...........%.......6.......P.......S...h...\.......@.......:...Z...4.......8......>.......<...B...B.......$.....................#...&.......J.......f...........!....... ......!..................'.......G.......f..................................$......"...........*.......>.......Y.......v...................................................../.......L.......e....................................................../.......G.......d.......................................... ......."...<......._.......}...7...&...2...^...P.......E......6...(......._.......m.......|............................................................................................(.......5.......Q......._.......}.................................................6..........(.......3.......?.......N......._.......j.......u...........'.......&...

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-bg.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 2546 messages, Project-Id-Version: BitCometGUI '\320\230\320\274\320\277\320\276\321\200\321\202\320\270\321\200\320\260\320\275\320\265 \320\275\320\260 DHT \321\202\320\276\321\200\320\265\320\275\321\202\320\270'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):317212
                                                                                                                                                              Entropy (8bit):5.667610833617664
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6144:TSgqES2y/YeFNGuDv69Xu299mQdkgnD91XM/6naHUNHvCK2TAauWv3qm:2gPE1329kQdka1XM/AaHUF6K2TAyv3qm
                                                                                                                                                              MD5:B1DDD9E96EEA1E69386BEBD7A1A1DBAA
                                                                                                                                                              SHA1:88AA14F32C68E286AF67E941D153BED7FA9B1603
                                                                                                                                                              SHA-256:B5F336D27EDA0CF2E98CE1E95362AA5B24AF88982F1767003D6B8AEC22909D72
                                                                                                                                                              SHA-512:B2AB065B1BA3DA0C823CE4EE29239A6527151F200D46DC01F38730BF2D410D485165BBFDDF19E10D521ECF0C9B4E5CF00055262DBD5ED9952CDFB736F49585B3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.................O..O...<.......x...%...y...%.......+.......(.......&.......)...A...#...k...#.......).......&.......$.......'...).......Q...".......;.......&...............$.......!...@...%...b..."......................."...............'.......>...F...I.......".......&...............9...5...<...o...7...............%.......'...%...6...M...P.......S.......\...)...@.......:.......4.......8...7...>...p...<.......B.......$.../.......T.......p...........#.......................................!...M... ...o...!.......................!...............)...1.......[.......u...................................#.......$...$..."...I.......l...........................".......J...........D.......`.......~.......................................................:.......V.......s...........................8...........!.......;.......S.......p...O...................^.......~...=...................................3... ...S..."...t...........P.......E.......6...L...............................................

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-bs.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 226 messages, Project-Id-Version: BitCometGUI 'Gre\305\241ka pri otvaranju torrenta'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):17394
                                                                                                                                                              Entropy (8bit):5.28120117659183
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:QLutcjsJte7/lNvwFIlDyXo7KkJusaeINm31GnjfWvo:xtwktG/ldlDyXo7KkJvaetuOA
                                                                                                                                                              MD5:16484FF35831E513CE54BB81F75EA1D8
                                                                                                                                                              SHA1:9B381519293B46F2BA28BF12623D99B21DC9F6B2
                                                                                                                                                              SHA-256:2C81FEBF21A11200B202A86DC653B82B40CE1270DBAD2B8FF6678A52CABDF45D
                                                                                                                                                              SHA-512:A0D4E5B9989EFA3A94026734FD5DF5F59A7675081BF06F2C27B44953674E7EF686CA8236F9A287BD3AA0569725A0DECF1EEDF9DFC4C67F8C29A69AC4E6AB3F88
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:................,...3...<...........$.......%......."...T.......w...>.......I.......&... .......G...%...b...6.......P.......S...........d.......r.......}...................................................................................7...........D......._...L...~...............................................8.......V.......t...#...................................................=..."...\........... .......*.......%.......!......."...2.......U...#...u.......................................................,.......E.......d..........................."......."...............-...;...O...i...........................!.......%...2...%...X...$...~...6.......!.......".......#.......A...C...........................................................#...8.......\...'...y...*.......;.......;.......@...D...!.......!.......+.......M...........C ..*...r ..(.... ..(.... ..+.... ..&....!..+...B!..)...n!..(....!..&....!..,....!..+....".. ...A".."...b".."...."......."..#...."..&...."..)....#..'...<#..-...

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-ca.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 421 messages, Project-Id-Version: BitCometGUI 'Ha fallat l'Obertura del Torrent'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):33735
                                                                                                                                                              Entropy (8bit):5.29330825400782
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:gJvzYtJi2/13lDXrn2S3jyORqkqDyXo7kJNvl1xeAoxtfGNQSC+BH/:AuV13lDXrn2S32OR/qDyXo7kJNvPxeAF
                                                                                                                                                              MD5:E0DDB43B7CB773F65DD57560103D91C4
                                                                                                                                                              SHA1:7EBD19FBC9833D71215939E64D394F588FA76EDD
                                                                                                                                                              SHA-256:718B12371EC6542CAFB502831FC3F17E52ED62A88BAF4DF98F246CC83C08F04E
                                                                                                                                                              SHA-512:E34F98C429640BE63B6C3DC56A50B2315355081F4B17F5859885B5074B84E3EADFF483530B1D6BF5799DCD584A8ACD839DCBFF9139BECAD1DE6B63C3A20A1791
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:................D...3...l.......8#..$...9#..%...^#.."....#.......#..=....#..>....$..I...D$..&....$.......$..%....$..@....$..:...7%..4...r%..$....%.......%.......%.......&......'&..!...F&.. ...h&..!....&.......&.......&.......&.......'.......'......3'......P'......l'.......'.......'.......'.......'.......'.......(......&(......?(......\(......z(.......(.......(.......(.......(.......)......!)......A)......a)..7....)..2....)..P....)..E...;*..6....*.......*.......*.......*.......*.......*.......+.......+.......+......)+......7+......D+......S+......j+......w+.......+.......+.......+.......+.......+.......+..6....+......+,......6,......B,......Q,......b,..'...m,..&....,..$....,..7....,.......-.. ...1-......R-..S...h-.......-..&....-..............".......=...,...\.........../.......#.......I..../..L...V/..-..../......./......./......./.......0.......0......40......O0......m0.......0.......0..4....0.......0..#....1..6...:1..&...q1.......1.......1.......1.......1.......2......*2......C2......

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-cs.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 930 messages, Project-Id-Version: BitCometGUI 'Selhalo otev\305\231en\303\255 torrentu'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):85953
                                                                                                                                                              Entropy (8bit):5.550252031843765
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:yITUQExX5i1VGHFwZytzlzXrnJS3WODKjWDqLyXo7KBkJ7Zf/Xk8io58eRr03fGw:yCEUGHeZGzzWDqLyXo7KBkJ7Zf/nRr05
                                                                                                                                                              MD5:01ED28E68AEC7A7C5C643B2C41F9EC0C
                                                                                                                                                              SHA1:D518F747478C0F6D8C2BB07B7143D51D379538FC
                                                                                                                                                              SHA-256:F0EF326E0576663CE3B70E260554F174CE8CD9791FF372DEF086B0D3CFD9BEFC
                                                                                                                                                              SHA-512:1040CDD61D9DC2EF2CDA02A7EA9B67C46A4B1081C8574CE0DD1FFA7CBECA7772DA9AF996A9335EC4CE607427933E643E1055D09EC66270B24B16878DF64189B9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:................,.......<:.......M..$....M..%....M.."....N....../N..=...ON.......N..'....N..>....N..I....O..&...WO......~O..%....O..\....O..@....P..:...]P..4....P..$....P.......P..#....Q......6Q......RQ......qQ..!....Q.. ....Q..!....Q.......Q.......R......3R......RR......lR.......R.......R.......R.......R.......R.......S......,S......ES......_S......vS.......S.......S.......S.......S.......S.......T......;T......TT......sT.......T.......T.......T.......T.......T.......U......8U......XU......wU.. ....U.."....U.......U.......U..7....W..2....W..P....X..E...^X..6....X.......X.......X.......X.......Y.......Y......&Y......2Y......@Y......LY......ZY......gY......vY.......Y.......Y.......Y.......Y.......Y.......Y.......Z.......Z..6...(Z......_Z......kZ......zZ.......Z.......Z..'....Z..&....Z..#....[..$...8[..7...][.......[.. ....[.......[..S....[......8\..e...X\..&....\.......\.......].......]..,...>]..!...k]..2....].......]../....]..#....^..I...C^..L....^..-....^......._......._......,_......

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-da.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 566 messages, Project-Id-Version: BitCometGUI 'Downloadet fil mangler'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):49173
                                                                                                                                                              Entropy (8bit):5.3495103985495716
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:FaPX90u3K9Xrnt13COVY1ODyXo7BkJZO9RrxZfLOLXDak1QZTDpKrbFWtYZl3SI:cqu3guODyXo7BkJZO9RrxhLOLXDak1Qi
                                                                                                                                                              MD5:3760138D7545FD652ABD090AA93EB5E2
                                                                                                                                                              SHA1:F9EA18F84EF9B08B00700BE6AA65B2D9D9D7CA02
                                                                                                                                                              SHA-256:7B81D667C03245799B16C30B67517C6D3CB7D60B2BBC058D37C641FF3A30558D
                                                                                                                                                              SHA-512:CB1E7B976D1247324DF3A920EDBECCF61A0F63F3EFC532803B5C11DD42AB63B43F22BC50EEE7F5767BBCC2A690067B2CCE02E533370650258C706FC70FC48C13
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:........6...............|#......P/..&...Q/......x/..$..../..%..../.."..../......./.......0..=...20......p0..'....0..>....0..I....0..&...:1..7...a1.......1..%....1..6....1..P....2..S...b2..\....2..@....3..:...T3..8....3..>....3..<....4..B...D4.......4.......4.......4.......4..!....5.. ...#5..!...D5......f5.......5.......5.......5.......5.......5.......6......06......L6......j6.......6.......6.......6.......6.......6.......7......#7......@7......`7......y7.......7.......7.......7.......7.......8......+8......K8......j8.. ....8.......8.......8..7...r:..2....:..P....:..E....;..6...t;.......;.......;.......;.......;.......;.......;.......<.......<.......<......'<......5<......B<......Q<......h<......t<.......<.......<.......<.......<.......<.......<.......<.......=......%=..6...3=......j=......v=.......=.......=.......=.......=.......=..'....=..&....>..#...6>..$...Z>..7....>.......>.. ....>.......>..S....?......Z?..e...z?..&....?.......@......&@......A@..,...`@..!....@..2....@..!....@..%...

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-de.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 2546 messages, Project-Id-Version: BitCometGUI 'Importieren von DHT-Torrents'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):254805
                                                                                                                                                              Entropy (8bit):5.4962201524894745
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:TSgqDPvy6jP5/Y+NPZDqL+yXo7KBk7Z5tNnbrF12OTvDv9vpnuoXBsbrO:TSgqDPvy6jP5/YeFNGuDv9xnbXBsPO
                                                                                                                                                              MD5:04B7541A5CA38A70B4F98318BC468F8D
                                                                                                                                                              SHA1:71B9DEF4DECAE5B01E62C395CA00BF5E58615290
                                                                                                                                                              SHA-256:BA318FD08BC1F5CE7F0F502FA5F0D5879E08E3C21F470F8161EF3E97036F96BC
                                                                                                                                                              SHA-512:4C5149D9530944FEDA66DE47905B2C427F8FA8F62E69D29217843E867E2477D1F0C0F53E71BF4619E13FB9FBA7955BB3A72B8342713080537B6A94BDDF5D6FD5
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.................O..O...<.......x...%...y...%.......+.......(.......&.......)...A...#...k...#.......).......&.......$.......'...).......Q...".......;.......&...............$.......!...@...%...b..."......................."...............'.......>...F...I.......".......&...............9...5...<...o...7...............%.......'...%...6...M...P.......S.......\...)...@.......:.......4.......8...7...>...p...<.......B.......$.../.......T.......p...........#.......................................!...M... ...o...!.......................!...............)...1.......[.......u...................................#.......$...$..."...I.......l...........................".......J...........D.......`.......~.......................................................:.......V.......s...........................8...........!.......;.......S.......p...O...................^.......~...=...................................3... ...S..."...t...........P.......E.......6...L...............................................

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-el.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 703 messages, Project-Id-Version: BitCometGUI '\316\244\316\277 \316\272\316\261\317\204\316\265\316\262\316\261\317\203\316\274\316\255\316\275\316\277 \316\261\317\201\317\207\316\265\316\257\316\277 \316\273\316\265\316\257\317\200\316\265\316\271.'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):66493
                                                                                                                                                              Entropy (8bit):5.664557677237806
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:b1Ypdfzi3K9XrnItS3uOODqyXo7KBkJ7ZFrhs20qEMeulNd0Zs/:b1YPfzi3THDqyXo7KBkJ7ZFrhh7N0s/
                                                                                                                                                              MD5:7B0785478939E921BACC9AD2B3FA1F2F
                                                                                                                                                              SHA1:FE0FF144D3C866A4A9C4C494C798A8D7B286C06A
                                                                                                                                                              SHA-256:C59927FD512B6ED15061FB208E4ABD399DFF351FC57158F8D71F8C1333A7AD9F
                                                                                                                                                              SHA-512:ECC0FBF70DFDE05944DC7E006E49612C293597001DCF4F78A075F542282DBE4055D911E3CA0E6BB59BC9CC093013F02241E5F42C4411C57D813119F5EA168026
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.........................,.......:..&....:.......:..$....:..%....;.."...8;......[;......{;..=....;.......;..'....;..>....<..I...P<..&....<..7....<.......<..%....=..6...:=..P...q=..S....=..\....>..@...s>..:....>..8....>..>...(?..<...g?..B....?.......?.......@......#@......B@..!...a@.. ....@..!....@.......@.......@.......A......#A......=A......UA......rA.......A.......A.......A.......A.......A.......B.......B......HB......cB.......B.......B.......B.......B.......B.......C......+C......IC......cC......{C.......C.......C.......C.......C.......D....../D.. ...OD.."...pD.......D..7....D..2....D..P....E..6...mE.......E.......E.......E.......E.......E.......E.......E.......F.......F...... F.......F......;F......JF......aF......mF......zF.......F.......F.......F.......F.......F.......F.......F.......G......(G..6...6G......mG......xG.......G.......G.......G.......G.......G..'....G..&....G..#....H..$...9H..7...^H.......H.. ....H.......H.......H..e....I..&...kI.......I.......I.......I..,....I..!...

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-en_US.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 8 messages, Project-Id-Version: BitCometGUI 'Download &Later'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):825
                                                                                                                                                              Entropy (8bit):5.25896861909364
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:u0UMebQKteDfVt0dmEXmN41h1Cjll9LeW:uTPbQKteDfMd+W101eW
                                                                                                                                                              MD5:4448D0219AB842ACF1257DCFC1E58FB5
                                                                                                                                                              SHA1:E3B6E17FADDF387B985BC9C94F0E58CC9F38D137
                                                                                                                                                              SHA-256:7C1BFEACBAA2E1216CAD280A056C486EE9E723F4ED5045EF798CE0BE3F4259F7
                                                                                                                                                              SHA-512:DB576DE90007D9D9A8CAA915083E5817B59683AC16FD1284C225C9CB1DBD1142C1411749176E93CAE6E4A2918025678525005C3C169878A7320B324C7A90649D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:................\............................................................... ......./.......=............................... .......&.......,.......3................................................Common.Download Later.Common.Download Now.MainMenu.CometID.MainMenu.File.MainMenu.Help.MainMenu.Tools.MainMenu.View.Project-Id-Version: BitCometGUI.Report-Msgid-Bugs-To: .PO-Revision-Date: 2024-05-15 21:08+0800.Last-Translator: wxhere <wxhere@hotmail.com>.Language-Team: .Language: en.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.X-Poedit-KeywordsList: _:1g.X-Poedit-Basepath: ../../...X-Poedit-SourceCharset: UTF-8.X-Generator: Poedit 3.4.2.X-Poedit-SearchPath-0: GUI_BitComet.X-Poedit-SearchPath-1: GUI_wxCommon..Download &Later.&Download Now.&CometID.&File.&Help.&Tools.&View.

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-es.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 2546 messages, Project-Id-Version: BitCometGUI 'Importaci\303\263n de torrents DHT'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):254698
                                                                                                                                                              Entropy (8bit):5.446352914535548
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:TSgqykO/uRZ0/Y+NPZDqL+yXo7KBk7Z5tNnbrF12OTvDvi5nZ68OreoZw5Xi:TSgqBTZ0/YeFNGuDv3Gi
                                                                                                                                                              MD5:693D948A494F8D9C77E8C5602A5F5F24
                                                                                                                                                              SHA1:80434D623E064113F23464A648060FCEAD59DA15
                                                                                                                                                              SHA-256:83242DD59CF22CAB9FBC8A1568A741E6C350216E7B87E4087EF364BDC36CE27A
                                                                                                                                                              SHA-512:A09EDFA8547EF7C512096DEC7DD97AB394F6DA297C011511BD95A830DEBF54076E37A8BE7CBB4DC2B00188390CD8840E92AE865046E8D27B6B94A5D9C702435D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.................O..O...<.......x...%...y...%.......+.......(.......&.......)...A...#...k...#.......).......&.......$.......'...).......Q...".......;.......&...............$.......!...@...%...b..."......................."...............'.......>...F...I.......".......&...............9...5...<...o...7...............%.......'...%...6...M...P.......S.......\...)...@.......:.......4.......8...7...>...p...<.......B.......$.../.......T.......p...........#.......................................!...M... ...o...!.......................!...............)...1.......[.......u...................................#.......$...$..."...I.......l...........................".......J...........D.......`.......~.......................................................:.......V.......s...........................8...........!.......;.......S.......p...O...................^.......~...=...................................3... ...S..."...t...........P.......E.......6...L...............................................

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-et.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 1503 messages, Project-Id-Version: BitCometGUI 'Allalaetud fail puudub'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):144199
                                                                                                                                                              Entropy (8bit):5.466221999648207
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:K1++RyrV8WujaGZc4i3sGtDqLyXo7KBkJ7Z+MPfRrFswE41P9DoxH/6xY/:AcrjQZvi3sGWS41P9DoxH/F
                                                                                                                                                              MD5:ABB1F7D28652A9B78CB1D5B93D12FA4A
                                                                                                                                                              SHA1:BCBCC76418A75BCBFEFC8741BFEFDE8201E352CC
                                                                                                                                                              SHA-256:F57F38B9FD1AE8CCF9ADACE896FAC953A8E7ECF034DADE32EF95A878F3BD2D11
                                                                                                                                                              SHA-512:14B7A805A25E369535BEC0FB941E611FC87F605B7C7BCAF48E4E3730C0E120F11D98E3D8872BD9CF0FF943F1246EB55E67D3DD120379C35DC16E5E115A0C1F59
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:................./.......^......x}..&...y}.......}..$....}..%....}.."....~......#~......C~..=...Z~.......~..'....~..>....~..I.......&...b...7...............%.......6.......P...9...S.......\......@...;...:...|...4.......8......>...%...<...d...B..............#...........(.......D.......c...!....... .......!.........................%.......D.......^.......{...$......."..................................0.......N.......g..................................................... .......=.......].......v.....................................................?.......Z.......z........... ......."......................7......2.......P.../...E.......6..................................(.......=.......H.......T.......b.......n.......|............................................................................3.......B.......].......l...6...z...............................................................'...9...&...a...#.......$.......7.............. ...!.......B...S...X...........e...

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-eu.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 1531 messages, Project-Id-Version: BitCometGUI 'Jeitsitako agiria galduta'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):150126
                                                                                                                                                              Entropy (8bit):5.417292852336041
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:Ci8oOQEy3SanDqLyXo7KBkJ7ZiPUfRrFsw44hReQ/wf1oBZNsWSKkUv/z:aoGy3SaSFh4Q/wf1oBZNsWSyvr
                                                                                                                                                              MD5:2D2406AEC6027D8F8ACC794CA5826C69
                                                                                                                                                              SHA1:6B96109BDB00C0C83240FBE0E4AD399E13115507
                                                                                                                                                              SHA-256:4E3A2EDAEE9E3C51682B02154FD4D11CE8F34CF4A6AB7EF970749966415EA499
                                                                                                                                                              SHA-512:CD2D255002D09677D3740331F4450E779CF025E02E113DB8CE273ACCF0A36768496C6C3A1F0D996996487060462F4C8DDB830E67D632589AAB369315A5408175
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:................./......._..........&...............$.......%...B..."...h...................=..............'.......>...A...I.......&......7..........)...%...D...6...j...P.......S......\...F...@.......:......4.......8...T...>.......<......B.......$...L.......q...#..............................!....... ...1...!...R.......t............................................. ...$...9..."...^..................................................... .......:.......Q.......k....................................................../.......N.......l......................................................3.......R... ...r..."......................7...}...2.......P......E...9...6........................................................................&.......2.......@.......M.......\.......s.............................................................................+.......:...6...H.................................................................'.......&.../...#...V...$...z...7...........

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-fa.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 33 messages, Project-Id-Version: bitcomet '\330\247\330\252\330\265\330\247\331\204 \332\251\330\247\330\261\330\263\330\247\330\262'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2784
                                                                                                                                                              Entropy (8bit):5.647303891867452
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:fyIcQrtrkM2dKVdIpFBKO48ZjRjFIIej1Tmcempw5sZmDeuHaIOCQ4NZA64g:hcQ6MtVdfqOTmcDaSZmiugCQyf9
                                                                                                                                                              MD5:B9B569AEC4DEA98925E8C51D3FF306A5
                                                                                                                                                              SHA1:17F1EEA85A81E2B847E9C960CD9E54F80E063515
                                                                                                                                                              SHA-256:24BF125098F9EFAE31E054ACD01B18933436A6A35F6EDBBCD30CD871C3955945
                                                                                                                                                              SHA-512:909FD35AC1D1C87AE2CECCBAAC2F4791CD1839A845B29F8A2B79191CEBC516A440918C67BB1436F9FD53DE6A94E6ADCB4C26EADE04CAE182F37359DF3A2844CA
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:........!.......$.../...,...........&...........................,.......A.......L.......W.......c.......q.......~...................................................................'.......7...%.......].......x...I.......L.......-...........\.......m...........................................$...................5.......A...(...N.......w...........................................#...........................................................,.......3.......O.......e.......v...I.......`......./...>.......n.......{...............................................................................................................................!................................................................................................... ....CView_Passport.Connecting to Server....Common.&Apply.Common.&Close.Common.&Download Now.Common.&No.Common.&OK.Common.&Yes.Common.Cancel.Common.Close.Common.Disable.Common.Download &Later.Common.False.Common.OK.Common.Tip.Common.True.Common.Unknown.Common.

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-fi.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 1254 messages, Project-Id-Version: BitCometGUI 'Torrentin Avaaminen Ep\303\244onnistui'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):115345
                                                                                                                                                              Entropy (8bit):5.437925370762981
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:JWPGIdMhIzDDqyXo7KBkJ7Z3Wl5RrFsrhfCmodfJMrMjjBin:gPWqzVus8
                                                                                                                                                              MD5:2CC0680872FB6188E3DE92E70D1D5FCF
                                                                                                                                                              SHA1:986B050CD5648F369D5314522914F568E83DE9F1
                                                                                                                                                              SHA-256:3D3FD27E6A6D9D0C2E0CCDA2C6EB61C0BF2441C4E8FFEA0ED5830FB7034D659C
                                                                                                                                                              SHA-512:A5A9C559847D0EF3D05DBC4EF3BEE88483EC542D1D19EF4AC685E1C0E644CD8BD0CE4A267A0A48AA9E32C2A3D05FDD0495D632E08230CCFBE8F7824A4810849E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:................L'......|N.......h..$....h..%....i.."...<i......_i..=....i.......i..'....i..>....i..I...=j..&....j..7....j.......j..%....k..6...'k..P...^k..S....k..\....l..@...`l..:....l..4....l..8....m..>...Jm..<....m..B....m..$....n.......n..#...Nn......rn.......n.......n..!....n.. ....n..!....o......1o......Oo......oo.......o.......o.......o.......o.......o.......p.......p......Jp......hp.......p.......p.......p.......p.......p.......q.......q......:q......Wq......wq.......q.......q.......q.......q.......q.......r......9r......Yr......tr.......r.......r.. ....r.."....r.......s......5s..7....t..2....u..P...Iu..E....u..6....u.......v......%v......4v......Bv......Wv......bv......nv......|v.......v.......v.......v.......v.......v.......v.......v.......v.......w......*w......8w......Sw......bw..6...pw.......w.......w.......w.......w.......w.......w..'....x..&...@x..#...gx..$....x..7....x.......x.. ....y......!y..S...7y.......y..e....y..&....z......8z......Wz......rz..,....z..!....z..2...

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-fr.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 2546 messages, Project-Id-Version: BitCometGUI 'Importation de torrents DHT'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):260676
                                                                                                                                                              Entropy (8bit):5.501983572987285
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6144:TSgq8NRvgo/YeFNGuDvE8hSGs2UDX3CS1:2g96E1M8hZs2Ur3/1
                                                                                                                                                              MD5:4C31B8FD1CC14AD68C9A7D524E610FA0
                                                                                                                                                              SHA1:99110392345CEB33E86A19B46505875BA1C07EBC
                                                                                                                                                              SHA-256:8EC4792E9318C2AC694FB5429E5768B0160E615EBF8A9E0FF9A12513F25D92AF
                                                                                                                                                              SHA-512:A4B3FE5B9CBA26B98BCF7623E7E83887246FA3B27830B2291B2E18B40663233A05D1AEBC3C86198A77A6008F58233409BA7327E0FC2C1F37E3952E8BE737105A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.................O..O...<.......x...%...y...%.......+.......(.......&.......)...A...#...k...#.......).......&.......$.......'...).......Q...".......;.......&...............$.......!...@...%...b..."......................."...............'.......>...F...I.......".......&...............9...5...<...o...7...............%.......'...%...6...M...P.......S.......\...)...@.......:.......4.......8...7...>...p...<.......B.......$.../.......T.......p...........#.......................................!...M... ...o...!.......................!...............)...1.......[.......u...................................#.......$...$..."...I.......l...........................".......J...........D.......`.......~.......................................................:.......V.......s...........................8...........!.......;.......S.......p...O...................^.......~...=...................................3... ...S..."...t...........P.......E.......6...L...............................................

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-gl.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 715 messages, Project-Id-Version: BitCometGUI 'Erro ao abrir un arquivo torrent'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):67341
                                                                                                                                                              Entropy (8bit):5.3222621889384225
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:8/z/F+Nby2pMullXrnpS3WO00DqLyXo7BkJ7Z8TXk8io58eRrFM9WyPKPZSZiPmL:M/FHBup0DqLyXo7BkJ7Z8TnRrFMkCKkf
                                                                                                                                                              MD5:5FFA81C4B392BCDB886BF6D8775F4C6F
                                                                                                                                                              SHA1:B291757D227834523FDC437007B854E7FC1538C6
                                                                                                                                                              SHA-256:AA35DD868BDA15F75A6E86E98F3DDEADDD8E1DB7870AADE6E6FEC77EA9B75358
                                                                                                                                                              SHA-512:F5CA2DB220E82844246B846A1940C5938AA16A29538E438DC8E1225A5236C72A3FC17E0FEB86354C1A51DAA87466309A1CD17A355114C7AA366C3E16FE43DDC7
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:................t........,.......;..$....;..%....;.."....;.......<..=...?<..I...}<..&....<.......<..%....=..\.../=..@....=..:....=..4....>......=>......]>......y>.......>..!....>.. ....>..!....>.......?......:?......Y?......s?.......?.......?.......?.......?.......?.......@......2@......L@......g@.......@.......@.......@.......@.......@.......A....../A......MA......gA.......A.......A.......A.......A.......A.......B......3B......SB......qB.......B.......B.......B.......B.......B.......B.......B.......B.......B.......B.......C...... C......-C......7C......FC......TC......_C......kC......zC.......C..'....C..&....C..#....C..$....D..7....D......fD.. ...~D.......D..S....D.......E..e...)E..&....E.......E.......E.......E..I....F..L...YF..-....F.......F.......F.......F.......G.......G......7G......RG......pG.......G..4....G.......G..#....G..6....H..&...UH......|H.......H.......H.......H.......H.......I......'I......EI.."...dI.......I..*....I..&....I..8....I..*...1J..%...\J..!....J..&....J.."...

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-he.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 894 messages, Project-Id-Version: BitCometGUI '\327\244\327\252\327\231\327\227\327\252 \327\224\327\230\327\225\327\250\327\240\327\230 \327\240\327\233\327\251\327\234\327\224'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):89370
                                                                                                                                                              Entropy (8bit):5.54925735006217
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:K7qhrxUodO1qN/pJ8/CF55HOulmXrn0S32O6wDqLyXo7KBkJ7ZOJXk8io58eRrFT:K7qTdO76LuuLwDqLyXo7KBkJ7ZOJnRr1
                                                                                                                                                              MD5:E6B2FA95D3E0E62A617128F37B314688
                                                                                                                                                              SHA1:D864D3B9199C348F96CE8237DBA25215B037D972
                                                                                                                                                              SHA-256:2B21646FDA5076251071F03F5E1ADA3CC80175885694BB18106DA6264831B889
                                                                                                                                                              SHA-512:2E6D084A2D1A34A6E87BD52673A85196E99965F99CBE152B5E84C60167A2AFCD4BC38C6426412D8F4AD0AA6EBBBC7294EAE82FB85FE8A12942D2DEC533F6A9ED
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:........~................7.......J..$....J..%....J.."....J.......K..=.../K..I...mK..&....K.......K..%....K..\....L..@...|L..:....L.......L.......M......4M......SM..!...rM.. ....M..!....M.......M.......M.......N.......N......FN......cN......|N.......N.......N.......N.......N.......O.......O......7O......TO......mO.......O.......O.......O.......O.......O.......P......3P......PP......pP.......P.......P.......P.......P.......P.......Q.......Q......*Q......5Q......@Q......LQ......XQ......fQ......sQ.......Q.......Q.......Q.......Q.......Q.......Q.......Q.......Q.......Q.......R..'....R..7...7R......oR.......R..I....R..L....R..-...@S......nS.......S.......S.......S.......S.......S.......S.......T..4...(T......]T..#...vT..6....T..&....T.......T.......U......4U......OU......lU.......U.......U.......U.."....U.......V.. ...!V..*...BV..&...mV..8....V..*....V..%....V..!....W..&...@W.."...gW..+....W.......W..!....W..%....W..'....X.. ...FX..#...gX.......X.......X.......X.......X.......X.......Y......

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-hr.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 170 messages, Project-Id-Version: BitCometGUI 'Priklju\304\215ivanje u tijeku...'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):13451
                                                                                                                                                              Entropy (8bit):5.286014272768912
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:EnONpYsnZFVYDyXo7KkJL2TquimzD9ActTS:EnOnn6DyXo7KkJiTqQ6cte
                                                                                                                                                              MD5:042A8E17E22BE5D96A12DE425ADFD469
                                                                                                                                                              SHA1:E8595B70551BE528E4E3C9B5CD16BA0BF33267FB
                                                                                                                                                              SHA-256:F6B97EBE708E43B7886F400F197C8B8E5AA8A0747DC338729B31347588DBE6F6
                                                                                                                                                              SHA-512:D314F3D5206F8E95A212A53FB0CD2C16259BED586EB6766C0F7A7790C3B21ED4178B2DD460DBD233C28B4412D9468D8A0FB3615F06017C474F75ED964545FBF1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:................l...............H...&...I.......p...................!...........................$.......2.......A.......\...-...|...O...........................3...!...Q.......s...%.......%.......$.......6.......!...;..."...]...#.......A...................................5.......K.......a.......y...........#.......................'...........:...*...i...;.......;.......@.......!...M...!...o...+...............*.......(.......(...@...+...i...&.......+.......).......(.......&...;...,...b...+......."......."...............#... ...&...D...)...k...'.......-.......-.......,.......#...F...$...j...).......".......*.......2.......)...:.......d...........................%...........................).......8.......K.......Z.......o....................................................................... .......7.......H.......a..."...r...M...............+...i...R.......F.......!.../.......Q.......g.......~...".......).......*.......'.......%...6...#...\...,.......*.......................W...........

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-hu.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 1307 messages, Project-Id-Version: BitCometGUI 'Torrent Megnyit\303\241sa Sikertelen'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):131351
                                                                                                                                                              Entropy (8bit):5.551408926943811
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:nHwV6Myo930437oDqLyXo7KBkJ7Z0PGfRrFsrhUGN4Vr6ogsxb:nHDMjB375yUX1
                                                                                                                                                              MD5:BF58953E42BB5B746177C67BE666F599
                                                                                                                                                              SHA1:329B909A8C23F38ABBB8E9D45EFE092A0B301B91
                                                                                                                                                              SHA-256:3950DA5A3CF5A72FB22ECBAB045C4A23910E02BDA4C1E1ED34EE63D24A4856DF
                                                                                                                                                              SHA-512:50A8114217757181A928779F41B8B71714FE3F3019961A3299FDCD969F44C1E27DC83A1AB687FE21BC894298F22F9968D49204CC192A1CC35457749B8F56A910
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.................(.......Q.......m..$....m..%...>m.."...dm.......m..=....m..>....m..I...$n..&...nn.......n..%....n..\....n..@...3o..:...to..4....o..$....o.......p......)p......Ep......dp..!....p.. ....p..!....p.......p.......q......%q......?q......\q......uq.......q.......q.......q.......q.......r.......r......1r......Kr......fr.......r.......r.......r.......r.......r.......s.......s......Ls......fs......~s.......s.......s.......s.......s.......t......2t......Rt......pt..7....v..2...Qv..P....v..E....v..6....w......Rw......`w......ow......}w.......w.......w.......w.......w.......w.......w.......w.......w.......w.......x.......x......8x......Fx......dx......rx......|x.......x..6....x.......x.......x.......x.......x.......y..'....y..&...:y..#...ay..$....y..7....y.......y.. ....y.......z..S...1z.......z..e....z..&....{......2{......Q{......l{..,....{..!....{..2....{.......|../...<|..#...l|..I....|..L....|..-...'}......U}......f}......y}.......}.......}.......}.......}.......}.......~..4...

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-hy.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 144 messages, Project-Id-Version: bitcomet '\325\200\325\241\325\275\325\241\325\266\325\245\325\254\325\253 \325\247 \325\266\325\270\326\200\325\235 ${VERSION_TEXT} \325\277\325\241\326\200\325\242\325\245\326\200\325\241\325\257\325\250'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):9747
                                                                                                                                                              Entropy (8bit):5.472037277067749
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:o1e/dpd1j18Twe32Ta2M6JK8jZTv9Kz9zG7CiYKBxoBra2YE9NObvGnDPyztd2Cj:o1+dprjWTwc2uGtT/YKBAYEhKZTm8f
                                                                                                                                                              MD5:E8AB5F1BAB1E56F0D4C195DF6E7BC431
                                                                                                                                                              SHA1:6B455732671FFC2CEAF70A839025FC1E8F600DBA
                                                                                                                                                              SHA-256:1DD5CE59C2CE9ACBF6DB9B798303EFA279A058B63DAD0B882CDEA02176150E53
                                                                                                                                                              SHA-512:38955AE60740B544D01E672B465508D6A9D9D20590CE6C41255F1C55BACB5655B6B50B723826762454096F3AA9CCBC3CBD66B64581AA52B415CCB29A194E17E8
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:................................ ...=...!......._.......m.......................................................................................................(...'...3...7...[...............................................................0.......N.......l........................... .......#...........".......;.......Q.......n...........................................#...........;.......T.......m.......................................................$.......:.......R.......o...................................(.......'.......&...F..."...m...........#...............................).../...)...Y.......................................................................%.......8.......I......._.......q.......................................................................#.......9.......P...#...g...............................................................:.......S.......n.......................................................).......A.......X.......q.......................................

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-id.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 442 messages, Project-Id-Version: bitcomet 'Gagal membuka Torrent'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):30816
                                                                                                                                                              Entropy (8bit):5.1741497290231315
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:i+BZjIFrQ7cyr0O6XrnBS3x8DyXo7BkZ7UMMxKEGEAn/E9EcxM:LjISQO16XrnBS3ODyXo7BkZILRTA/jcS
                                                                                                                                                              MD5:BF59C6DDC06AABA5CF9B389AE2E4EC03
                                                                                                                                                              SHA1:FC313F377FC1C27DE18AD142351E9389A7003B15
                                                                                                                                                              SHA-256:34907CF45B50A364F079418A36AE0D630BB3CBC027EC3FCB6A831224B539BFF0
                                                                                                                                                              SHA-512:4DED403169E168DEBA1A40B21F8477E2BE024304825953E038755E41E918D5EBBCDE4267CB78EC03ABE0D2501C1007B6752FD8458B1CAC85E127171609CA030B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:....................Q............%..$....%..%...&%.."...L%......o%..=....%..&....%.......%.......&....../&..!...N&.. ...p&..!....&.......&.......&.......&.......'......#'......?'......]'......w'.......'.......'.......'.......'.......'.......(......=(..7...](.......(.......(.......(.......(.......(.......(.......(.......(.......).......).......)......,)......C)......P)......l)......z).......).......).......).......).......).......).......)..'....)..7....*.. ...F*......g*......}*.......*..I....*..L....+..-...N+......|+.......+.......+.......+.......+.......+.......,..4...%,......Z,..#...s,..6....,..&....,.......,.......-......1-......J-......h-.."....-.......-..&....-..8....-..*...)...%...T...!...z...&.......".......+............/..%...2/..'...X/.. ..../..#..../......./......./......./.......0......%0......;0......V0......n0.......0..!....0..!....0.......0.."....1..?...-1..3...m1..N....1..J....1..!...;2..6...]2..@....2..e....2......;3......U3......p3.......3.......3.. ....3..9....3..%...

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-it.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 2546 messages, Project-Id-Version: BitCometGUI 'Importazione di torrent DHT'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):252025
                                                                                                                                                              Entropy (8bit):5.42891561508422
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6144:TSgqf3+DWPWq4/YeFNGuDvwzBPLo7gUaoEgYWVWxKPDughqUcf8SVokmh5frgm+9:2g1KHE1oL
                                                                                                                                                              MD5:412DEDBDED36CCB2D40694F0E30FD8D4
                                                                                                                                                              SHA1:ACBB2D99515A19BBA30F565E9A5F44946E084340
                                                                                                                                                              SHA-256:B37450EC4C3A6C1FA7E2186B36042217A01B12C25BFBDB131849C7B5DD7F7A22
                                                                                                                                                              SHA-512:E12B15724B7B0DCD744FA7765000B79C23C6C53D5465E908AB9A952AA7996A7FFA0552B61A62FA9EA9086121DFC0C57F02F9C0489282D2B2C4D8E59AE3799C50
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.................O..O...<.......x...%...y...%.......+.......(.......&.......)...A...#...k...#.......).......&.......$.......'...).......Q...".......;.......&...............$.......!...@...%...b..."......................."...............'.......>...F...I.......".......&...............9...5...<...o...7...............%.......'...%...6...M...P.......S.......\...)...@.......:.......4.......8...7...>...p...<.......B.......$.../.......T.......p...........#.......................................!...M... ...o...!.......................!...............)...1.......[.......u...................................#.......$...$..."...I.......l...........................".......J...........D.......`.......~.......................................................:.......V.......s...........................8...........!.......;.......S.......p...O...................^.......~...=...................................3... ...S..."...t...........P.......E.......6...L...............................................

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-ja.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 2546 messages, Project-Id-Version: BitCometGUI 'DHT\343\203\210\343\203\254\343\203\263\343\203\210\343\201\256\343\202\244\343\203\263\343\203\235\343\203\274\343\203\210'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):274990
                                                                                                                                                              Entropy (8bit):6.109582793019566
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:TSgqP6cS/Y+NPZDqL+yXo7KBk7Z5tNnbrF12OTvDv1b/+aHLrrqg3zTfHhfbxt:TSgqk/YeFNGuDv4aHLrrjzTDt
                                                                                                                                                              MD5:10C68A3AAA22F2F647CA4B2CBDB6D4F4
                                                                                                                                                              SHA1:3CC4D8CEF58EE5639C93B4A54812AE634A9D3175
                                                                                                                                                              SHA-256:CB131B09C2B02C39F4900552746009C5E215D45C581405078990499BC5029F21
                                                                                                                                                              SHA-512:C90EBF4EA35DA37AC6E8F53E2DAF2F44F49944BD9CA25BEEE8543D3B7DDB6A2E0855883705D7EE9EA0D8F550203A515491DD03D19029051E6AEEE92BA0F755DD
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.................O..O...<.......x...%...y...%.......+.......(.......&.......)...A...#...k...#.......).......&.......$.......'...).......Q...".......;.......&...............$.......!...@...%...b..."......................."...............'.......>...F...I.......".......&...............9...5...<...o...7...............%.......'...%...6...M...P.......S.......\...)...@.......:.......4.......8...7...>...p...<.......B.......$.../.......T.......p...........#.......................................!...M... ...o...!.......................!...............)...1.......[.......u...................................#.......$...$..."...I.......l...........................".......J...........D.......`.......~.......................................................:.......V.......s...........................8...........!.......;.......S.......p...O...................^.......~...=...................................3... ...S..."...t...........P.......E.......6...L...............................................

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-kk.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 1008 messages, Project-Id-Version: bitcomet '\320\242\320\276\321\200\321\200\320\265\320\275\321\202 \320\260\321\210\321\203\321\213 \321\201\323\231\321\202\321\201\321\226\320\267'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):108050
                                                                                                                                                              Entropy (8bit):5.787902717821965
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:p8JJ6qnpm5wufDqLyXo7KBkJ7ZH7NtrFpNT0XB9RSz6EyGh:KJFqwuWVT0X/RSz6EyGh
                                                                                                                                                              MD5:BBF673D10A2A56BA6A2528A902A9FB71
                                                                                                                                                              SHA1:4B1124C2DA49646A68D9D97DDBB16D8BDC935C6A
                                                                                                                                                              SHA-256:99036119A6ED32D4BF4F470D1CA7EEDF36C4D92F20972E8E4C0278BB69CDB8EA
                                                                                                                                                              SHA-512:228F2771F65FF57021EE95EA78243642D58C9A0B77B573CC9E2D38466D2A4684AF6F84E8463E89D66CAEF519A97D48E5C9CD91346F00D9F5C3DF1FE344493D8D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:....................Q....?......`T..$...aT..%....T.."....T.......T..=....T..I...-U..&...wU.......U..%....U..\....U..@...<V..:...}V..4....V.......V.......W......)W......HW..!...gW.. ....W..!....W.......W.......W.......X......#X......7X......OX......lX.......X.......X.......X.......X.......X.......Y......$Y......>Y......UY......oY.......Y.......Y.......Y.......Y.......Y.......Z......5Z......SZ......mZ.......Z.......Z.......Z.......Z.......Z.......[......9[......Y[......w[.......[.......[.......[.......[.......[.......[.......[.......[.......[.......\.......\......$\.......\......=\......K\......V\......b\......q\.......\..'....\..&....\..#....\..$....]..7...%]......]].. ...u].......]..S....].......^..e... ^..&....^.......^.......^.......^..I...._..L...P_..-...._......._......._......._.......`.......`.......`......I`......g`.......`..4....`.......`..#....`..6....a..&...La......sa.......a.......a.......a.......a.......b.......b......;b.."...Zb......}b.. ....b..*....b..&....b..8....c..*...

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-kn.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 48 messages, Project-Id-Version: bitcomet '\340\262\237\340\263\202\340\262\260\340\263\206\340\262\202\340\262\237 \340\262\244\340\262\260\340\263\206\340\262\257\340\262\262\340\263\201 \340\262\206\340\262\227\340\263\201\340\262\244\340\262\277\340\262\262'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4344
                                                                                                                                                              Entropy (8bit):5.432069751364534
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:TOCDz5VhfKLMIxNfzJwTmOgKmqMG8yYZrDcIZmRPiyR5ifdaN15xQcgKjj:TOCDzpfKLMIxVCTuHZcqmxi4gdI15x3B
                                                                                                                                                              MD5:FEA30E3D435220F6585BCC6B36800E23
                                                                                                                                                              SHA1:D69D882DD03A8A9E0641F9F84176F10AD9E3178E
                                                                                                                                                              SHA-256:0B532AE300D321E1C736BEE0C73A0D501C16AF176C9E32EFD58A73E934FD0A3D
                                                                                                                                                              SHA-512:48F7754CBED9B01061EEADA2580F71D2082087CD65B7EA5E16D9FD4B3387B1718AA426D70D56F4108A9DAABA8A2D05A860F1484078F336C76686C43D8490219E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:........0...........C...........(...$...)...%...N..."...t...........=...............'.......>...6.......u...............................................................................................&.......9.......M.......^.......x.......................................................8.......T.......j.......................................................).......B.......\...#...y...................................8.......W...M...8.......,.......h.......(...t...'.......R...................5.......L.......].......z...-...........................................................&.......6.......O.......b...'...y....................................................... .......<.......O.......h...........-.......C...........................;.......T.......g.......z......................................./...................$...#...................(... ...........................0.......)...........'...............+...-...%......."...............................................!...............

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-ko.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 2546 messages, Project-Id-Version: BitCometGUI 'DHT \355\206\240\353\240\214\355\212\270 \352\260\200\354\240\270\354\230\244\352\270\260'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):254851
                                                                                                                                                              Entropy (8bit):6.171297470371061
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6144:TSgqZhM+/YeFNGuDvoj6+McgRnymVX3iG/eJfcvWNL:2gRE1AjGcgt535veL
                                                                                                                                                              MD5:F094D0922D40BB37BA4D09946AAF3416
                                                                                                                                                              SHA1:D17245119918C7B6A38AEAC40CE520E7DEABBDCE
                                                                                                                                                              SHA-256:68EFF47A9BDF6FEA6A39BF9A5EF7A4EFD368EA78E28E8419E723B9B2623C9D2F
                                                                                                                                                              SHA-512:84F7559AC082CA6BD9E94F4B81769E87AE160EB7A8D910A354866D6086F3C0DA29F87FF97D5E379844287F73C7B135A9BABB156B25FA6659D07A15ED1A1BCB7B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.................O..O...<.......x...%...y...%.......+.......(.......&.......)...A...#...k...#.......).......&.......$.......'...).......Q...".......;.......&...............$.......!...@...%...b..."......................."...............'.......>...F...I.......".......&...............9...5...<...o...7...............%.......'...%...6...M...P.......S.......\...)...@.......:.......4.......8...7...>...p...<.......B.......$.../.......T.......p...........#.......................................!...M... ...o...!.......................!...............)...1.......[.......u...................................#.......$...$..."...I.......l...........................".......J...........D.......`.......~.......................................................:.......V.......s...........................8...........!.......;.......S.......p...O...................^.......~...=...................................3... ...S..."...t...........P.......E.......6...L...............................................

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-ku.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 1002 messages, Project-Id-Version: BitComet 1.36 '\331\201\330\247\333\214\331\204\333\214 \330\257\330\247\332\257\333\214\330\261\330\247\331\210 \331\206\330\247\330\257\330\261\331\210\330\263\330\252\333\225.'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):88100
                                                                                                                                                              Entropy (8bit):5.719674972761057
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:yqAJU6xoJhgu7loLG3KoXrnyLS3FO84ByXo7KBkJZ+S0OEcxjEEYrLZ4a:bA0JOuqLG3w7yXo7KBkJZ+S0O2hLZB
                                                                                                                                                              MD5:F28DFE3A18903EAF3B33349E5E72146A
                                                                                                                                                              SHA1:AB62345234C97939A03527B8C98BE0579E504EB1
                                                                                                                                                              SHA-256:6087DFBA2A97F1C8B6F1D4C31E9CC2B9B06EF7542F7BC5CF5E1D2EE88622CD1E
                                                                                                                                                              SHA-512:E2F33AE9A302D8FCEB853DFA7B2B305E0DC180841906F0DF21F2799800C2057E4D8D4DE236FE28420D620F2789D5352338DFA164529730BA74702636884124EF
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:................l...Q....>.......T..&....T......(T..$...=T..%...bT.."....T.......T.......T..=....T...... U..'...9U..>...aU..I....U..&....U..7....V......IV..%...dV..6....V..S....V..8....W..B...NW.......W.......W..#....W.......W.......X....../X..!...NX.. ...pX..!....X.......X.......X.......X.......Y......*Y......>Y......VY......sY.......Y.......Y.......Y.......Y.......Y.......Z......)Z......CZ......^Z......{Z.......Z.......Z.......Z.......Z.......[......$[......A[......^[......~[.......[.......[.......[.. ....[.."....\......<\..7...Z\..2....\..P....\.......]......$]......3]......A]......V]......a]......l]......x].......].......].......].......].......].......].......].......].......^.......^......4^......B^......W^......a^......p^.......^.......^.......^.......^.......^.......^.......^.......^.......^..'...._..#...)_..$...M_..7...r_......._.. ...._......._......._..&....`......@`......_`......z`..,....`..!....`..2....`..!....a..%...=a.. ...ca..#....a..L....a..-....a......#b......4b......

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-lt.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 494 messages, Project-Id-Version: BitCometGUI 'Parsi\305\253stas failas nerastas.'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):40650
                                                                                                                                                              Entropy (8bit):5.4004763704881995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:39AK0nvOU3lkXrnZ6AS3jyOD0s/DyXo7KkJ4Tpeknyj5sKjtdP/:tAK0nvOU3lkXrngAS3WODd/DyXo7KkJr
                                                                                                                                                              MD5:8F522C8CE3A317132E47FA8100D2FD80
                                                                                                                                                              SHA1:8259A43DF9185075D56A261287CDB820CEECDCED
                                                                                                                                                              SHA-256:B083B9A9034F2780C67E87FB68B2D4CEF213D5E7629FBE738CB31571A2BF7FC0
                                                                                                                                                              SHA-512:8267D4276DE9170267A799A5DD44AD7B8BBBA5562C59972CB97F83174A411A8032CA5BF32477A26BE16A8D3F86800252F6B706D263E28066BDFBBE48966E3BF1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:................................H)..&...I)......p)..$....)..%....).."....).......).......*..=...**......h*..'....*..>....*..I....*..&...2+......Y+..%...t+..6....+..P....+..S...",..\...v,..@....,..:....-..4...O-..8....-..>....-..<....-..B...9...$...|...........#..................../...... /..!...?/.. ...a/..!..../......./......./......./.......0.......0......80..$...Q0.."...v0.......0.......0.......0.......0.......1......$1......>1......U1......o1.......1.......1.......1.......1.......1.......2......32......R2......p2.......2.......2.......2.......2.......2.......3......73......V3.. ...v3.."....3.......3.......3..7....5..2....5..P....5..E...=6..6....6.......6.......6.......6.......6.......6.......7.......7.......7......*7......67......D7......Q7......`7......w7.......7.......7.......7.......7.......7.......7.......7.......8.......8....../8......>8..6...L8.......8.......8.......8.......8.......8.......8.......8.......8..'....9..&...39..#...Z9..$...~9..7....9.......9.. ....9.......:..S...

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-lv.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 234 messages, Project-Id-Version: BitCometGUI 'Atv\304\223rt torrent failu neizdev\304\201s'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):18893
                                                                                                                                                              Entropy (8bit):5.432514511334486
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:J/FlqhPMc7k9Ch1KkXrnUfDyXo7KkLgnjlHCms97DCIOVAbI2OBBA:JSRMc7ka1KkXrnsDyXo7KksnjlCoIOVa
                                                                                                                                                              MD5:158F9240165BFB25865077CE639E8AAE
                                                                                                                                                              SHA1:83A2D91C8676690694048D662720F406DE0A314E
                                                                                                                                                              SHA-256:A5AD1C609D269BBA4B8325B26B78EC05191445EA083622DA87AD9194FD56A644
                                                                                                                                                              SHA-512:5F2BD3F51B9CDB43ACF838F36112743961E5E50D814216FE8C672663683CB78063B752C02DAA2349893C4CBDA299F0BF4102E96D1A8B573BF90CFED6649F61CB
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:................l...9...............$.......%...............=...........J...'...c...>.......I.......&.......7...;.......s...%.......6.......P.......S...<...\.......@.......:.......4...i...8.......>.......<.......B...S...$...............#...........................:...!...Y... ...{...!...........................................5.......M.......j.......................................................(.......?.......Y.......v...............................................!.......?.......Y.......q...............................................%... ...E..."...f...........7.......2.......P.......E...c...6........................................... .......+.......6.......B.......P.......\.......j.......w...........................................-.......O.... ......l ....... ..!.... ....... ..%.... ..%....!..$...6!..6...[!..!....!.."....!..#....!.......!......."....../"......J"......`"......x"......."..#...."......."......."..'....#..*...9#..;...d#..;....#..!....#..!....#..+... $......L$..*...

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-mk.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 731 messages, Project-Id-Version: bitcomet '\320\236\321\202\320\262\320\260\321\200\320\260\321\232\320\265\321\202\320\276 \320\275\320\260 \321\202\320\276\321\200\320\265\320\275\321\202\320\276\321\202 \320\265 \320\275\320\265\321\203\321\201\320\277\320\265\321\210\320\275\320\276'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):71602
                                                                                                                                                              Entropy (8bit):5.591626256005003
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:X5aYw9Q3zKMXrncS32OjK97DyXo7KBkJZSpyRC91o7emFoNuoK/llusHFA:oYw9yz07DyXo7KBkJZSJIpOAz/lluuA
                                                                                                                                                              MD5:C57AD970AF8DB18A97079B8E8B4E4A7C
                                                                                                                                                              SHA1:844ACA8B587B31F3EFCB4EC2FE64731285E8675F
                                                                                                                                                              SHA-256:A0AB991E42F968666E8FF523D495EA93FE50E06C6DDC391E6D49FD6A6944C6E7
                                                                                                                                                              SHA-512:466E070F1A8AACDAD5D4313C5424CDDC38A6DCEB39406076258FF1CA08A27E8B503FAC39AD1DD4E0977D5DB8C43D935F3BEC4A2528A2E9AE5C4003E2279E02E6
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.........................-.......=..$....=..%...6=.."...\=.......=..=....=.......=..'....=..>....>..I...]>..&....>..7....>.......?..%...!?..6...G?..P...~?..S....?..\...#@..@....@..:....@..8....@..>...5A..<...tA..B....A.......A..#....B......8B......TB......sB..!....B.. ....B..!....B.......B.......C......5C......TC......nC.......C.......C.......C.......C.......C.......D......%D......>D......XD......oD.......D.......D.......D.......D.......D.......E......3E......QE......kE.......E.......E.......E.......E.......E.......F......7F.. ...WF.."...xF.......F.......F..7...bH..2....H..P....H..E....I..6...dI.......I.......I.......I.......I.......I.......I.......I.......I.......J.......J......%J......2J......AJ......XJ......dJ......qJ.......J.......J.......J.......J.......J.......J.......J..6....K......@K......KK......WK......fK......wK.......K..'....K..&....K..#....L..$...$L..7...IL.......L.. ....L.......L..S....L......$M..e...DM..&....M.......M.......M.......N..,...*N..!...WN..2...yN.......N../...

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-ms.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 255 messages, Project-Id-Version: bitcomet 'Fail yang telah dimuatturun hilang'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):19402
                                                                                                                                                              Entropy (8bit):5.257817451926557
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:rUg4opisGdZxq8f3KDXrnIS3IyO7YzcmkuFE1qWlYUzj:ggpGZxd3KDXrnIS3IyO7YCIWlYUzj
                                                                                                                                                              MD5:1AB217436EF4E60F08761115AD9A4940
                                                                                                                                                              SHA1:3F65029AF73AC05116B7A879A7B48E5450F377E4
                                                                                                                                                              SHA-256:A9FB1BC53C286B85458AF91F3C5396A2F6F627D22947A4EDDA642341A19D3EC1
                                                                                                                                                              SHA-512:48C5AB9E0856CBAC08704344995A4952546D3594FCB5E9EC8C3CD77CD0FDFE88406E7EF94D89D113841D1742C503BCB684D740EE56E8AC57164A6753F7B1CA5D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:....................[...........x...&...y...........$.......%......."...........#.......C...=...Z...........'.......>.......I.......&...b...7...............%.......6.......P...9...S.......\.......@...;...:...|...4.......$...................1.......M.......l...!....... .......!...........................-.......G.......d.......}...............................................".......9.......S.......n.......................................................3.......P.......p........................... ......."...............7...L...2.......P...........................%.......3.......H.......S......._.......k.......y................................................................ ....... ......% ......@ ..6...O ....... ....... ....... ....... ....... ..'.... ..7.... .. ...(!......I!......_!......~!.......!..!....!..!....!.. ....!..#...."..I...A"..L...."..-....".......#.......#......*#......>#......X#......s#.......#..4....#.......#..#....#..6...!$..&...X$.......$.......$.......$.......$......

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-nb.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 1209 messages, Project-Id-Version: BitCometGUI 'Feil:'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):114109
                                                                                                                                                              Entropy (8bit):5.405577031957202
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:ZMxZf6JKEHNZDx2DqLyXo7BkJ7ZZnQfRrFs5ylm6W/A1NwkcXP6q3A8zqCtjjksR:yZf6kEHNZDxPeykllA8zqCV
                                                                                                                                                              MD5:A23E230EF7F6C598585F4107ED576F0C
                                                                                                                                                              SHA1:0CA4E19596176826CB60616715250323B1843B22
                                                                                                                                                              SHA-256:B81320AEE7E1BA5014D85ED4B8857108F550DE821EEB42308140C472BDB8EE39
                                                                                                                                                              SHA-512:07AC5571F7F12D7007C9208109713B867F277BCA9570A0A2F54257659CB1F678F921666A21C3422987999EA0C8C5BF6B89DE4CADDA6F51064157CCDFF8AEEB51
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.................%..M....K.......d.......d..$....d..%....e.."...Ae......de.......e..=....e..'....e..>....f..I...@f..&....f.......f..%....f..\....f..@...Og..:....g..>....g..<....h..$...Gh......lh.......h.......h.......h..!....h.. ....i..!...)i......Ki......ii.......i.......i.......i.......i.......i.......j......,j......Jj......cj......}j.......j.......j.......j.......j.......j.......k......9k......Yk......rk.......k.......k.......k.......k.......l......!l......<l......\l......{l.. ....l.."....l.......l.......l..7....n..2....n..P....o..E...bo..6....o.......o.......o.......o.......p.......p......*p......6p......Dp......Pp......^p......kp......zp.......p.......p.......p.......p.......p.......p.......q.......q.......q.......q......=q......Kq......Vq......bq......qq.......q.......q.......q..'....q..&....q..#....q..$....r..7...<r......tr.. ....r.......r..S....r.......s..e...7s..&....s.......s.......s.......s..!....t..!...?t.. ...at..#....t..I....t..L....t..-...=u......ku......|u.......u......

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-ne.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 459 messages, Project-Id-Version: bitcomet '\340\244\244\340\245\213\340\244\260\340\245\207\340\244\250\340\245\215\340\244\244 \340\244\226\340\245\213\340\244\262\340\244\250\340\244\276 \340\244\270\340\244\225\340\244\277\340\244\257\340\245\207\340\244\250\340\244\276'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):50942
                                                                                                                                                              Entropy (8bit):5.360270094955925
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:oksP3MUlBS32O/bDqLyXo7KBkJ7ZEEOEuMR+:oksPcUibDqLyXo7KBkJ7ZEEOEuMR+
                                                                                                                                                              MD5:817007B32AFD44F2499F8BD5692D5450
                                                                                                                                                              SHA1:498BF7BCFD39569CB42553F1430C031D619FBC09
                                                                                                                                                              SHA-256:B10C609012E169DEAD0A466AF438ECCCECB423CB8A98402E67ECD07CC07ED209
                                                                                                                                                              SHA-512:8071D727B5031BE2A1EFB73E3685F7F4A6A6EC6F70855525580FAB8929F611EA8F9F6798E2F51AA08CB8FAE4ACB57943DEC54444307C0E645BCFF4173270141D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:................t...e...........`&..$...a&..%....&.......&..=....&..I....'..&...T'......{'..%....'.......'.......'.......'.......(.......(......4(......O(......l(.......(.......(.......(.......(.......(.......)....../)......L)......g)......u).......).......).......).......).......).......).......).......).......).......).......*......#*......-*......<*......J*......U*......a*......p*.......*..$....*..7....*.......*.. ....+......"+......8+......S+..I...r+..L....+..-....,......7,......H,......[,......o,.......,.......,.......,.......,..4....,......&-..#...?-..6...c-..&....-.......-.......-.......-..............4.......Q.......n..................."............... ..../..*...'/..&...R/..8...y/..*..../..%..../..!....0..&...%0.."...L0..+...o0.......0..!....0..%....0..'....1.. ...+1..#...L1......p1.......1.......1.......1.......1.......1.......2.......2......22..!...Q2..!...s2.......2.......2.......2.......2.."....3..?...)3..3...i3..N....3..J....3..!...74..6...Y4..@....4..e....4......75......

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-nl.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 2546 messages, Project-Id-Version: BitCometGUI 'DHT Torrents importeren'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):248748
                                                                                                                                                              Entropy (8bit):5.447083467379101
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:TSgqv5QM6/Y+NPZDqL+yXo7KBk7Z5tNnbrF12OTvDvLs6L+DyZlT10U:TSgqu/YeFNGuDvL317
                                                                                                                                                              MD5:D7C421B4E080BC4F135A38990816AC3E
                                                                                                                                                              SHA1:92637E4F5419F3151BA95506999C5E606F1D1C5F
                                                                                                                                                              SHA-256:FC1F9EE782AFB4EB75DBE67584D5B5261365B102E7FAA1B3268B51F4B1BA0555
                                                                                                                                                              SHA-512:266490B981F2B9497EADB5A39D97D69533D696FE29BC106723D3EF98D1D8EB56CBF1D3B249E2650CE43AE4847A7E7905E4E1392B168821866F53D8ED176B7ACB
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.................O..O...<.......x...%...y...%.......+.......(.......&.......)...A...#...k...#.......).......&.......$.......'...).......Q...".......;.......&...............$.......!...@...%...b..."......................."...............'.......>...F...I.......".......&...............9...5...<...o...7...............%.......'...%...6...M...P.......S.......\...)...@.......:.......4.......8...7...>...p...<.......B.......$.../.......T.......p...........#.......................................!...M... ...o...!.......................!...............)...1.......[.......u...................................#.......$...$..."...I.......l...........................".......J...........D.......`.......~.......................................................:.......V.......s...........................8...........!.......;.......S.......p...O...................^.......~...=...................................3... ...S..."...t...........P.......E.......6...L...............................................

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-pl.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 2546 messages, Project-Id-Version: BitCometGUI 'Importowanie torrent\303\263w DHT'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):253479
                                                                                                                                                              Entropy (8bit):5.626784500759554
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:TSgqeYY0Q/Y+NPZDqL+yXo7KBk7Z5tNnbrF12OTvDvZFFTzyRBT8y:TSgqeYjQ/YeFNGuDvpeRBTX
                                                                                                                                                              MD5:432DA0D61F5B94B9FF7366903FF9EB70
                                                                                                                                                              SHA1:5F235AD9D92B1B16A5CC32297F68229434CE9A08
                                                                                                                                                              SHA-256:CF62ECD170805EE035BF23FFBFC434597430074733E1F4391A77C8B519DD8EB0
                                                                                                                                                              SHA-512:07DEDE7CE2FC616715A97F15DE8B30F89F23AB7B637DD40E3ABD1886A3E358F6807FD25133FD622F55F6C0201B1819913B47AC0B4B697DE96132C81B0BB7F340
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.................O..O...<.......x...%...y...%.......+.......(.......&.......)...A...#...k...#.......).......&.......$.......'...).......Q...".......;.......&...............$.......!...@...%...b..."......................."...............'.......>...F...I.......".......&...............9...5...<...o...7...............%.......'...%...6...M...P.......S.......\...)...@.......:.......4.......8...7...>...p...<.......B.......$.../.......T.......p...........#.......................................!...M... ...o...!.......................!...............)...1.......[.......u...................................#.......$...$..."...I.......l...........................".......J...........D.......`.......~.......................................................:.......V.......s...........................8...........!.......;.......S.......p...O...................^.......~...=...................................3... ...S..."...t...........P.......E.......6...L...............................................

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-pt.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 2546 messages, Project-Id-Version: BitCometGUI 'Importa\303\247\303\243o de torrents DHT'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):252743
                                                                                                                                                              Entropy (8bit):5.477563518092169
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:TSgqWg4vA8OQw/Y+NPZDqL+yXo7KBk7Z5tNnbrF12OTvDvYOQU5cOR+GBafvzGbl:TSgqWguZ4/YeFNGuDvzoGBaXk
                                                                                                                                                              MD5:B5EB6B5281AA6C67BF81A84E44389A46
                                                                                                                                                              SHA1:E03DEFA2FB02C569B362D056B3B44200EF4877F6
                                                                                                                                                              SHA-256:608820CF72425381E46C8E7667C7BB83D9D6926A38EC54A12FFF6CB5E5ABA3CE
                                                                                                                                                              SHA-512:0D449A6B9F3CB263C7ECC216EF7F940590A71373A83527384474649C8AFCE5C1B5FB6AB097F72F5B0F021D29561599F165BBE13DAA4FF57E12D137C2A17A1CB3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.................O..O...<.......x...%...y...%.......+.......(.......&.......)...A...#...k...#.......).......&.......$.......'...).......Q...".......;.......&...............$.......!...@...%...b..."......................."...............'.......>...F...I.......".......&...............9...5...<...o...7...............%.......'...%...6...M...P.......S.......\...)...@.......:.......4.......8...7...>...p...<.......B.......$.../.......T.......p...........#.......................................!...M... ...o...!.......................!...............)...1.......[.......u...................................#.......$...$..."...I.......l...........................".......J...........D.......`.......~.......................................................:.......V.......s...........................8...........!.......;.......S.......p...O...................^.......~...=...................................3... ...S..."...t...........P.......E.......6...L...............................................

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-pt_BR.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 2546 messages, Project-Id-Version: BitCometGUI 'Importa\303\247\303\243o de torrents DHT'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):253469
                                                                                                                                                              Entropy (8bit):5.479335447443177
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6144:TSgqKpPcOC/YeFNGuDv41M5SV5+rZa8XE:2gxxlE1M
                                                                                                                                                              MD5:D032CB2991996349803C3C2D7111B35C
                                                                                                                                                              SHA1:309CBC898DE73EBAFA94EE93249A98339A2C6B49
                                                                                                                                                              SHA-256:BEE9977645F353F13DA4DBEF541B61623091669FE72E221884D33B1348DFDE99
                                                                                                                                                              SHA-512:9E63FF773394BBF6A367EA657AA5F737D10F8532A446273F1AA1F83AF74D0E306F83A3DC110610E831CCC27DFD5CE53FC9EA042C304BE591EEE66D2BB64FFF03
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.................O..O...<.......x...%...y...%.......+.......(.......&.......)...A...#...k...#.......).......&.......$.......'...).......Q...".......;.......&...............$.......!...@...%...b..."......................."...............'.......>...F...I.......".......&...............9...5...<...o...7...............%.......'...%...6...M...P.......S.......\...)...@.......:.......4.......8...7...>...p...<.......B.......$.../.......T.......p...........#.......................................!...M... ...o...!.......................!...............)...1.......[.......u...................................#.......$...$..."...I.......l...........................".......J...........D.......`.......~.......................................................:.......V.......s...........................8...........!.......;.......S.......p...O...................^.......~...=...................................3... ...S..."...t...........P.......E.......6...L...............................................

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-ro.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 1505 messages, Project-Id-Version: BitCometGUI 'Fila desc\304\203rcat\304\203 lipse\310\231te.'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):151953
                                                                                                                                                              Entropy (8bit):5.482445008207694
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:zeLq8cV3FvhDqLyXo7KBkJ7ZaMUfRrFsw448BpQxh7wpAY:zeOVV3FvFF8BpywpAY
                                                                                                                                                              MD5:DA11A30FC8034D2547D1369BF973D834
                                                                                                                                                              SHA1:EEFB02A88D3C671C0D0A7B8B111E02756F0557AD
                                                                                                                                                              SHA-256:2678BDC488BFD5F532B5E22BE6748D36585CF7E1D11F8CD279626EC61D4D64EC
                                                                                                                                                              SHA-512:9E7F27C1FB53560FEE21695DD42FABBE01A543E73BB869EF4C1F486B9175AA3521F3277A324CCB95060146CBA5AF8EFA09C2F046A47BA9F19A19CAF4D09CBA77
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:................$/......,^.......}..&....}.......}..$....}..%....}.."... ~......C~......c~..=...z~.......~..'....~..>....~..I...8...&.......7...............%.......6..."...P...Y...S.......\.......@...[...:.......4......8.......>...E...<.......B.......$...........)...#...I.......m...................!...... ......!...........,.......J.......j.........................................$......."...*.......M.......a.......|.....................................................7.......R.......o.....................................................8.......R.......j......................................... ...#..."...D.......g...........7.......2...f...P.......E......6...0.......g.......u............................................................................................&.......B.......P.......n.......|...........................6..................................'.......8.......C.......N.......Z...'.......&.......#......$.......7...!.......Y... ...q...........S...........

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-ru.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 2546 messages, Project-Id-Version: BitCometGUI '\320\230\320\274\320\277\320\276\321\200\321\202 \321\202\320\276\321\200\321\200\320\265\320\275\321\202\320\276\320\262 DHT'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):306656
                                                                                                                                                              Entropy (8bit):5.759079628158406
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6144:TSgqrTNHP/YeFNGuDvi/+vdMVjqEjRvkOZSWduaSZO0XnPo1AnJMA/9pJl4TtR5I:2ggTl4E1qWvdMVjq4vVSWduaSZOKnPoo
                                                                                                                                                              MD5:549CE8CB82844238F0BF702DC72EA606
                                                                                                                                                              SHA1:1459728B30023D310C58B4A960A0698F95605608
                                                                                                                                                              SHA-256:97615A170A4F95FB7CB7EA230EF757B62FC0D12D9795B8A3CC464A650FFC06A2
                                                                                                                                                              SHA-512:C2C8D698BE203294BD84238F5F091CE5F8D4849CC45BB0452EF89CFB34AD96BAA13EC5C838015E2C4DABCE7041D655FD3C21AB1094A7290E4806826291FFF327
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.................O..O...<.......x...%...y...%.......+.......(.......&.......)...A...#...k...#.......).......&.......$.......'...).......Q...".......;.......&...............$.......!...@...%...b..."......................."...............'.......>...F...I.......".......&...............9...5...<...o...7...............%.......'...%...6...M...P.......S.......\...)...@.......:.......4.......8...7...>...p...<.......B.......$.../.......T.......p...........#.......................................!...M... ...o...!.......................!...............)...1.......[.......u...................................#.......$...$..."...I.......l...........................".......J...........D.......`.......~.......................................................:.......V.......s...........................8...........!.......;.......S.......p...O...................^.......~...=...................................3... ...S..."...t...........P.......E.......6...L...............................................

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-sk.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 1489 messages, Project-Id-Version: BitCometGUI 'Stiahnut\303\275 s\303\272bor ch\303\275ba.'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):148591
                                                                                                                                                              Entropy (8bit):5.624139854250813
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:ueGoKWWghWQz5y35CTDqLyXo7KBkJ7ZoTdfRrFsL4atXiQ7jgrxKSZMO:phZWcWp35ClpaSh
                                                                                                                                                              MD5:4C5F7A647C7C4F9B364670F7543C22D2
                                                                                                                                                              SHA1:7CCF4100FCB7926E43952B14E0583797A465ACF3
                                                                                                                                                              SHA-256:E10D45356C41CAFD990F274C60F5BBAFAD2C980F33352D9A8A0FE67C4F97F942
                                                                                                                                                              SHA-512:1A21AEF3D20827CF81770DCA54799BEC0FF486D9FF688D1077D89998C0334B68D19C35E5C8127C1373EE6E8ACC37FCBC38218C7907EFCCD862AA352DBD790675
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:........................,]......8|..&...9|......`|..$...u|..%....|.."....|.......|.......}..=....}......X}..'...q}..>....}..I....}..&..."~..7...I~.......~..%....~..6....~..P....~..S...J...\.......@.......:...<...4...w...8.......>......<...$...B...a...$..............#..................).......H...!...g... .......!.................................).......C...$...`..."..................................................3.......M.......d.......~.............................................).......B.......a.....................................................&.......F.......e... .......".....................7.......2......P.......E...L...6....................................................... ...............:.......H.......U.......d.......{.....................................................................).......8...6...F.......}..................................................'.......&..."...#...I...$...m...7.............. ..............S...........m...e.......&...

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-sl.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 274 messages, Project-Id-Version: BitCometGUI 'Prene\305\241ena datoteka je pogre\305\241ana.'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):20791
                                                                                                                                                              Entropy (8bit):5.25757244168817
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:LTFWj89XFQtLlcrnGS3j6FhlDyXo7Kk3CnTtY1mnb3KanRL+gePt9cT5M:LTFWVtLlcrnGS3j6DyXo7KkynTt7zb3C
                                                                                                                                                              MD5:DECDEADFD1148DC4F19C8DB430AE3C65
                                                                                                                                                              SHA1:E0CF96C47B1CD7D284FAFC94CFFB7526204352B9
                                                                                                                                                              SHA-256:7884D9F367A6797033F27EE9537BB3F9D3CE8EAAEBD9177096796CEA20EDD5D6
                                                                                                                                                              SHA-512:210B4D320877BC9B4EF365C18DF0FB7D19601191CB08DE319874D05C4AF4DF6B5788ED9A25DE27F5003F71BB5E6134F28A399FC27F9D5BFEC5311AF46EF48611
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:....................o...<...........&.......$... ...%...E..."...k...........=...............>.......I...D...&...............%.......\...........S.......o........... .......!...........................(.......@.......].......v.......................................................6.......Q......._.......m.......................................................................................................".......3...'...>...7...f...........................I.......L...8...-................................................... .......>...4...\...........#.......6.......&...........,.......I.......h...........................................".... ......6 .. ...U ..*...v ..&.... ..8.... ..*....!..%...,!..!...R!..&...t!.."....!..+....!.......!..!...."..%...,"..'...R".. ...z"..#....".......".......".......".......#.......#......5#......O#......j#.......#.......#.......#..!....#..!....#.......$......9$......V$......q$.."....$..?....$..3....$......!%......<%..-...\%..O....%.......%.......%..!...

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-sq.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 1100 messages, Project-Id-Version: BitCometGUI 'Hapja e Torrentit D\303\253shtoi'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):103737
                                                                                                                                                              Entropy (8bit):5.427063921692318
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:9fTxmaj6uJlDqLyXo7KBkJ7Z/DLnRrFMq8i:9fTP6uJyT8i
                                                                                                                                                              MD5:AA4E502B588DF06915701FBADF9982B8
                                                                                                                                                              SHA1:2EB8762DE7C7AFB7079786A2139B24422110433C
                                                                                                                                                              SHA-256:F62117D7A6CE8AF0DC8911FDB5029D9A5176AE01F7F3FC9494B81EC0AF2940DA
                                                                                                                                                              SHA-512:FADC2007E6DFA0585253FC322D1043BFAD6C18521D2ADC85409FFB393C86C4871A2F528727D2779D662D315ADEFA8C5556D97491F03B1DE71D26E934837BF690
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:........L.......|".......D.......[..$....[..%....[.."...$\......G\..=...g\..I....\..&....\.......]..%...1]..\...W].......].......].......].......^..!....^.. ...P^..!...q^.......^.......^.......^.......^......._......._......8_......S_......p_......._......._......._......._......._.......`......)`......F`......_`......|`.......`.......`.......`.......`.......a......)a......Aa......^a......{a.......a.......a.......a.......a.......b..7...3b..2...kb.......b.......b.......b.......b.......b.......b.......b.......c.......c.......c......-c......Dc......Qc......mc......{c.......c.......c.......c..6....c.......c.......d.......d......!d......2d..'...=d..&...ed..#....d..$....d..7....d.......e.. ...%e......Fe......\e..&...|e.......e.......e.......e..I....e..L...Ff..-....f.......f.......f.......f.......f.......g.......g......Lg......jg..4....g.......g..#....g..6....g..&...1h......Xh......uh.......h.......h.......h.......h.......i.......i......<i.."...[i......~i..*....i..&....i..8....i..*...(j..%...

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-sr.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 381 messages, Project-Id-Version: BitCometGUI '\320\236\321\202\320\262\320\260\321\200\320\260\321\232\320\265 \321\202\320\276\321\200\320\265\320\275\321\202\320\260 \320\275\320\270\321\230\320\265 \321\203\321\201\320\277\320\265\320\273\320\276'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):32831
                                                                                                                                                              Entropy (8bit):5.642345028830651
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:55yYsAnulmXrnAzS3jyOMcyXo7KkVN2FKhrC49n/+Et:55tnulmXrnoS3WOVyXo7KkVNPp9n/+Et
                                                                                                                                                              MD5:A5179B2B8F433114C545C73159ED7CC8
                                                                                                                                                              SHA1:AC2934E7B9CD54F796E17A07BE24E191802A3F13
                                                                                                                                                              SHA-256:07BA4D10A5F74DB6B4E80C3F81A91BA713AA85DB8DB5D609BADE54FE40241ED7
                                                                                                                                                              SHA-512:DAD935946E461F7407FC2507239470BA05511E31B4A4E3F0305D96452EE0547542E6C1CC8C8897B2EFE411E079786366E9243C6885B78DF695BEA9435FA0F343
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:........}...........................$.......%.... .."..., ......O ..=...o ..I.... ..&.... .......!..%...9!..\..._!..@....!..:....!......8"......X"......t"......."..!....".. ...."..!....".......#......5#......T#......n#.......#.......#.......#.......#.......#.......$...... $......7$......Q$......l$.......$.......$.......$.......$.......$.......%......4%......R%......l%.......%.......%.......%.......%.......%.......&......8&......X&..6...v&.......&.......&.......&.......&.......&.......&.......'.......'.......'......)'......6'......E'......\'......i'......s'.......'.......'.......'.......'.......'.......'..'....'..&....'..#...!(..7...E(......}(.. ....(.......(..S....(...... )..e...@)..&....).......).......).......*..I...&*..L...p*..-....*.......*.......*.......+......#+......4+......N+......i+.......+.......+..4....+.......+..#....,..6...5,..&...l,.......,.......,.......,.......,.......-......#-......@-......Y-......w-.."....-.......-.. ....-..*....-..&...$...8...K...*.......%.......!...

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-sv.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 1500 messages, Project-Id-Version: BitCometGUI 'Nedladdad fil saknas.'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):147016
                                                                                                                                                              Entropy (8bit):5.491405453248565
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:pvRY8mBmIPW938E7DqLyXo7BkJ7Z+MUfRrFsw44ndAHPp/AAEZM:pppWmUa38EeFnA3EZM
                                                                                                                                                              MD5:91FCEE0395D04D7944070E2F26A5E159
                                                                                                                                                              SHA1:AFADB2F947093BD941D6A6AF4EBA121DABF51BD3
                                                                                                                                                              SHA-256:7A90EA29E731B51D0722440B27155504D151FE9F43E19B23CC1035F8E2D04C78
                                                                                                                                                              SHA-512:2F6D344D664E4DB6381EC6FA82314949F6F9D38426721ABEABD5A1F9AA888D30FD6D9CEF39FD4764D762686BE0B9A77CB56F2BA2BF2923CEF4213BFA5620C538
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.........................]......(}..&...)}......P}..$...e}..%....}.."....}.......}.......}..=....~......H~..'...a~..>....~..I....~..&.......7...9.......q...%.......6.......P.......S...:...\.......@......:...,...4...g...8.......>......<.......B...Q...$...............#..........................8...!...W... ...y...!..........................................3.......P...$...i...".........................................".......9.......S.......n......................................................6.......T.......l............................................. ... ...@..."...a...................7...K...2.......P.......E.......6...M...................................................................................................6.......B.......O.......k.......y........................................................6...........B.......M.......Y.......h.......y...........................'......&......#.......$...=...7...b........... ..............S..........=...e...]...&...

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-ta.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 121 messages, Project-Id-Version: bitcomet '\340\256\244\340\256\260\340\256\265\340\256\277\340\256\261\340\256\225\340\257\215\340\256\225\340\256\252\340\257\215\340\256\252\340\256\237\340\257\215\340\256\237 \340\256\225\340\257\213\340\256\252\340\257\215\340\256\252\340\257\201 \340\256\225\340\256\276\340\256\243\340\256\265\340\256\277\340\256\262\340\257\215\340\256\262\340\257\210.'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):13075
                                                                                                                                                              Entropy (8bit):5.2715582084148975
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:XiGbIhhHIZObKnYKTJY6PXrnmJnkTMXDFmoyX1ElPZwlb6lj5+BGXMg8wBHzX7se:XTUP2+KfXrniHhmDlZAB7CabJl
                                                                                                                                                              MD5:BC079B7D77F12E6C973C83F909B3F3BF
                                                                                                                                                              SHA1:FD5DD2D6473598455A8B3BC694ED724A63C7F027
                                                                                                                                                              SHA-256:2863DBD88E7F409DF2D9A4A313E85051D20202B0FEEEF318BB8DA774A6D77112
                                                                                                                                                              SHA-512:F4289635C34F58E85BD2A1D8FB6354615BA7F5C4B7355DAFF8392FE075D74887590B69D64E08345086CA998FB8D701F09B90B240CBBB82B173958F520143CE8B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:........y.......................8...&...9.......`.......u...=...............>.......I..."...&...l...7...............%.......6.......P...C...\.......@...........2.......R.......n...........!....... .......!.................../.......O.......n...................$......."...................#.......?.......].......w.......................................................3.......L.......k.......................................................0.......P.......o... ......."...............P.......6...B.......y...............................................................................................*.......6.......C......._.......m...................................................................................'.......7...6.......n...........I.......L.......-...?.......m.......~...................................................4...'.......\...#...u...6.......&...........................3.......N.......k..........................."............... ... ...*...A...&...l...8.......*.......(...

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-th.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 2546 messages, Project-Id-Version: BitCometGUI '\340\270\201\340\270\262\340\270\243\340\270\231\340\271\215\340\270\262\340\271\200\340\270\202\340\271\211\340\270\262\340\270\227\340\270\255\340\270\243\340\271\214\340\271\200\340\270\243\340\270\231\340\270\225\340\271\214 DHT'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):352828
                                                                                                                                                              Entropy (8bit):5.50058189225239
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6144:TSgqlkdU/YeFNGuDvKTx9RGD4P4s1tR9+JQJaWW19YULb4ikT:2gnE1yTx9RGD4PV1tR9+JQJaT19FbdkT
                                                                                                                                                              MD5:343639B01B02D519BB8FBECF4BADFEDF
                                                                                                                                                              SHA1:938DE5467314BF3A0B76E1E8AFF7813BA5937171
                                                                                                                                                              SHA-256:37CDC7F3892CF52FF320E8E6ADE98E760DD46F67DAFA850BEC06A5C1365C3B3E
                                                                                                                                                              SHA-512:C3D1E2E51E9CD7EA96F32FD3D1DE14E3E31E3967C685AB285752D764D8F70C9BFBE292C2A4C7072929F833F96D4652C24960F0BBC741749EC687259DC9955E72
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.................O..O...<.......x...%...y...%.......+.......(.......&.......)...A...#...k...#.......).......&.......$.......'...).......Q...".......;.......&...............$.......!...@...%...b..."......................."...............'.......>...F...I.......".......&...............9...5...<...o...7...............%.......'...%...6...M...P.......S.......\...)...@.......:.......4.......8...7...>...p...<.......B.......$.../.......T.......p...........#.......................................!...M... ...o...!.......................!...............)...1.......[.......u...................................#.......$...$..."...I.......l...........................".......J...........D.......`.......~.......................................................:.......V.......s...........................8...........!.......;.......S.......p...O...................^.......~...=...................................3... ...S..."...t...........P.......E.......6...L...............................................

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-tr.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 1498 messages, Project-Id-Version: BitCometGUI '\304\260ndirilen dosya bulunamad\304\261.'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):147529
                                                                                                                                                              Entropy (8bit):5.5874451311886855
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:QhH1dtrCSFv3lEnDqLyXo7BkJ7ZPaUfRrFsL4UV2Qmo2u++OAI/S:QZtp3lEppUV2Qj/VOAI/S
                                                                                                                                                              MD5:1E5BCB8B3360FB8E6B070C1654F2D517
                                                                                                                                                              SHA1:D25099C20C913007CA09A9881C93F8CCEB0F395C
                                                                                                                                                              SHA-256:DE77F98F1DA1333AC0A90A975EC844382CB54529752F5F9515B8C30C12DEDD86
                                                                                                                                                              SHA-512:FB5666984BA0318B85C5D3B23520E8068EC75CF58E46936E8E0727F872CF5BB510A4D0BF63003302951451EC034537EF9F7214775891F4F0757BD0EA8A50E838
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.........................].......|..&....|.......}..$...-}..%...R}.."...x}.......}.......}..=....}.......~..'...)~..>...Q~..I....~..&....~..7...........9...%...T...6...z...P.......S.......\...V...@.......:......4.../...8...d...>.......<......B.......$...\...........#.............................!....... ...A...!...b.........................................$......."...=.......`.......{.....................................................6.......Q.......n......................................................7.......Q.......i................................................. ...=..."...^...................7...H...2.......P.......E.......6...J...................................................................................................'.......>.......J.......W.......s................................................................6...........J.......U.......a.......p...................................'......&.......#...!...$...E...7...j........... ..............S...

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-ug.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 1523 messages, Project-Id-Version: bitcomet '\332\206\333\210\330\264\333\210\330\261\332\257\333\225\331\206 \332\276\333\206\330\254\330\254\333\225\330\252 \331\212\331\210\331\202\330\247\331\204\330\272\330\247\331\206.'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):187783
                                                                                                                                                              Entropy (8bit):5.837738359094332
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:KBKKK5Qb6GZw3ApnDqLyXo7KBkJ7ZGMUfRrFsw44h7id2xMp0Z/fzgftA/9rdw87:KO58w3ApzFh7id2xMp0Z/fzgftA/9rdR
                                                                                                                                                              MD5:58B72181CC6A24F88BAB3CC1D6051D95
                                                                                                                                                              SHA1:21FA0D682AAC54178030C5FE57FED276D7944407
                                                                                                                                                              SHA-256:FF56E120FB4147FB9A7D2087350A6236C4BD65D6C37F2BE50171EFC4CBFAE5D0
                                                                                                                                                              SHA-512:041E3E34177F5A3F769DD0217065C787D57186FB380A1DD50185812DDBA52D90D7B7F0BD1EEDF3EE33A7D1A838A8051B6A17BE97D8EA9F16D13D686F6A54C5D3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:................./......L_......(...&...).......P...$...e...%.......".......................=...........H...'...a...>.......I......&.......7...9.......q...%.......6.......P......S...:...\.......@......:...,...4...g...8.......>......<.......B...Q...$...............#..........................8...!...W... ...y...!..........................................3.......G.......d...$...}..."........................................-.......K.......d.......~.....................................................:.......Z.......s.....................................................<.......W.......w........... ......."......................7.......2.......P...,...E...}...6..................................%.......:.......E.......P.......\.......j.......v............................................................................&.......;.......E.......T.......o.......~...6...................................................................'...K...&...s...#.......$.......7..........

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-uk.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 780 messages, Project-Id-Version: BitCometGUI '\320\237\320\276\320\274\320\270\320\273\320\272\320\260'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):79211
                                                                                                                                                              Entropy (8bit):5.677998258340325
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:ZG4aA3lXXrnScS3WOc9BtDqLyXo7KBkJ7ZLwTEYcItP5cv994:r73ZtDqLyXo7KBkJ7ZLaKa5uE
                                                                                                                                                              MD5:D54C08FDFFB9DA36B8AC1A64DB5AF39C
                                                                                                                                                              SHA1:10961F66D4744504CE400C6F68EFBBC107D02D71
                                                                                                                                                              SHA-256:2AA0300E8F0D4AC2E9EDE959EA38BF8488711B4A4B7D54F58213911FBDACF5AA
                                                                                                                                                              SHA-512:30767030C9EFF7888A6F713EF273CF8177DFE0F53C952F7A6596F6F40A79D6F1F3EA8356A4C49D7DE7CAB7DD52BD170CC3044472BB959CB2F38420979907AFDD
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:................|........0......@A......AA..$...VA..%...{A.."....A.......A.......A..=....A......9B..'...RB..>...zB..I....B..&....C......*C..%...EC..\...kC..@....C..:....D..$...DD......iD.......D.......D.......D..!....D.. ....E..!...&E......HE......fE.......E.......E.......E.......E.......E.......F.......F......9F......UF......sF.......F.......F.......F.......F.......F.......G......,G......IG......iG.......G.......G.......G.......G.......G.......H......+H......KH......fH.......H.......H.......H..P....H..E...4I..6...zI.......I.......I.......I.......I.......I.......I.......J.......J......!J......-J......;J......HJ......WJ......nJ......{J.......J.......J.......J.......J.......J.......J.......J..6....K......DK......OK......[K......jK......{K.......K.......K..'....K..&....K..#....K..$....L..7...5L......mL.. ....L.......L.......L..e....L..&...BM......iM.......M.......M..,....M..!....M..2....N.. ...DN..#...eN..I....N..L....N..-... O......NO......_O......rO.......O.......O.......O.......O......

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-ur.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 95 messages, Project-Id-Version: bitcomet '\330\247\333\214\332\251 \331\206\333\214\330\247 \331\206\330\263\330\256\333\201/\331\210\330\261\332\230\331\206 ${VERSION_TEXT} \330\257\330\263\330\252\333\214\330\247\330\250 \333\201\333\222\333\224'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):10459
                                                                                                                                                              Entropy (8bit):5.7319741588424815
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:hP5/5fgyxuLVTMXS3jMITN6UImqC6uGNR3Zesy0e/KUJkN7el8Pxx4H:V5/5YZLqS3jMD1mV6nL3sPChelvH
                                                                                                                                                              MD5:CE62B7876A009D1A98BFD36567A3D5E7
                                                                                                                                                              SHA1:1FFFF24B1C44A94C2DFF98CD4EB3D91062DBDD41
                                                                                                                                                              SHA-256:28688730B3CD989A4DB822DE95B4846FF49F29B7FDA684C81912657F5A81575B
                                                                                                                                                              SHA-512:F36FD7505910A293903A4CAFA4502303E8013447F3D14A7ADB70858CBBFE4EB3D8F24EC6CEA2B331D5266F380B994C0FC6EB5EC03912BEB573472045992ECD91
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:........_...........................=.......&...G.......n.......|...............................................................................................$.......0.......?.......P...'...[...7.......................I.......L...?...-...........................................................8.......V...4...t...........#.......6.......&...........D.......a..................................................."...+.......N... ...m...*.......&.......8.......*.......%...D...!...j...&.......".......+...............!..."...%...D...'...j... .......#...................................".......7.......M.......h...................!.......!...........................9.......T..."...m...?.......3.......N.......J...S...6.......N.......$...$...D...I...6.......#.......................a.......%.......C...!...F...e...................1...........................&.......0.......D.......S...H...i...........................................................3...........<...!...P.../...r...............;...~...

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-vi.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 1044 messages, Project-Id-Version: BitCometGUI 'T\341\272\255p tin \304\221\303\243 t\341\272\243i b\341\273\213 m\341\272\245t'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):108936
                                                                                                                                                              Entropy (8bit):5.779130754606995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:qgWBZvAY34RnDqLyXo7KBkJ7ZHMgfRrFsxYbMTF3CuhXfvcNiiMZQ1x5BXy:qgWbF34RKCV3FV5
                                                                                                                                                              MD5:EE2AD1854064EA151409AB3103CE7AFD
                                                                                                                                                              SHA1:43994BA96D40D199F69FDDBEA01B94E495C96FB1
                                                                                                                                                              SHA-256:8649BBF23875A626D858E899010165003F8A8060CAAFC37553E2381F7CF9DA69
                                                                                                                                                              SHA-512:E0A2644333E2805E67F5998A0B39D127A41901991FB26F0B7D26686DDDF6E6EAB0D03ACCCEC9D8F7EAECFB6D39FC7421FA0E1FB6016F6EABA35F93D5C7806955
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:................. ..w...\A......8W..&...9W......`W..$...uW..%....W.."....W.......W.......X..=....X......XX..'...qX..>....X..I....X..&..."Y..7...IY.......Y..%....Y..6....Y..P....Y..S...JZ..\....Z..@....Z..:...<[..4...w[..8....[..>....[..<...$\..B...a\..$....\.......\..#....\.......]......)]......H]..!...g].. ....]..!....].......].......].......^......)^......C^......`^..$...y^.."....^.......^.......^.......^......._......3_......M_......d_......~_......._......._......._......._.......`......)`......H`......f`.......`.......`.......`.......`.......`.......a......-a......La.. ...la.."....a.......a.......a..7...wc..2....c..P....c..E...3d..6...yd.......d.......d.......d.......d.......d.......d.......e.......e...... e......,e......:e......Ge......Ve......me......ye.......e.......e.......e.......e.......e.......e.......e.......f......%f......4f..6...Bf......yf.......f.......f.......f.......f.......f.......f.......f..'....g..&...)g..#...Pg..$...tg..7....g.......g.. ....g.......h..S... h......

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-zh_CN.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 2546 messages, Project-Id-Version: BitCometGUI '\346\255\243\345\234\250\345\257\274\345\205\245DHT\347\247\215\345\255\220\345\210\227\350\241\250'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):237607
                                                                                                                                                              Entropy (8bit):6.283094739136954
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:TSgq+EDnG5/Y+NPZDqL+yXo7KBk7Z5tNnbrF12OTvDv20yIDt5DaQwy:TSgq365/YeFNGuDvD57
                                                                                                                                                              MD5:FB4A5E33D0B319388484E64B0733B719
                                                                                                                                                              SHA1:CF03BDCD93ABCFDE4216013F9E4EEEB6D4D0C32F
                                                                                                                                                              SHA-256:7DC42AAF62F3A0385330050144DE915EB9BFCC68A5141B5615C663AD2DA83D6D
                                                                                                                                                              SHA-512:2100BAA678D5A0B2861E96158F6A0F7190577A44E036A8AB7E14868AF10DB5BD803D42582D153411F596CAB5769E19C510DF7684EAA38A25920CA37E027F9DA9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.................O..O...<.......x...%...y...%.......+.......(.......&.......)...A...#...k...#.......).......&.......$.......'...).......Q...".......;.......&...............$.......!...@...%...b..."......................."...............'.......>...F...I.......".......&...............9...5...<...o...7...............%.......'...%...6...M...P.......S.......\...)...@.......:.......4.......8...7...>...p...<.......B.......$.../.......T.......p...........#.......................................!...M... ...o...!.......................!...............)...1.......[.......u...................................#.......$...$..."...I.......l...........................".......J...........D.......`.......~.......................................................:.......V.......s...........................8...........!.......;.......S.......p...O...................^.......~...=...................................3... ...S..."...t...........P.......E.......6...L...............................................

                                                                                                                                                              C:\Program Files\BitComet\lang\bitcomet-zh_TW.mo

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:GNU message catalog (little endian), revision 0.0, 2546 messages, Project-Id-Version: BitCometGUI '\346\255\243\345\234\250\345\260\216\345\205\245DHT\347\250\256\345\255\220\345\210\227\350\241\250'
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):236606
                                                                                                                                                              Entropy (8bit):6.263383809077504
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6144:TSgqHrlaIy/YeFNGuDv4bQaDXr6C+z9g0:2ggRacE1z9g0
                                                                                                                                                              MD5:999B71370AE2B68D0DBB49D18FD2A4CF
                                                                                                                                                              SHA1:7204A6387E9BFC996911F05F0906E43EF9CB3233
                                                                                                                                                              SHA-256:0412BE7E7B38D24E1736F31A51B6AC054C496021D729EDD609CA6E6632009CC4
                                                                                                                                                              SHA-512:2E75402EDCB8E06596C9644E9B1459070FD7B176803EE0F338EC55A6663B34B91BC5925745D4CEE46AEA2EB8DAC33A6C2D504B61C2085B9313AA57D7207449C2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.................O..O...<.......x...%...y...%.......+.......(.......&.......)...A...#...k...#.......).......&.......$.......'...).......Q...".......;.......&...............$.......!...@...%...b..."......................."...............'.......>...F...I.......".......&...............9...5...<...o...7...............%.......'...%...6...M...P.......S.......\...)...@.......:.......4.......8...7...>...p...<.......B.......$.../.......T.......p...........#.......................................!...M... ...o...!.......................!...............)...1.......[.......u...................................#.......$...$..."...I.......l...........................".......J...........D.......`.......~.......................................................:.......V.......s...........................8...........!.......;.......S.......p...O...................^.......~...=...................................3... ...S..."...t...........P.......E.......6...L...............................................

                                                                                                                                                              C:\Program Files\BitComet\tools\BitCometAgent_1.92.7.9.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):892456
                                                                                                                                                              Entropy (8bit):6.672053011408752
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24576:13Nl5M13aSTbgmwPEEXeADIfNsZmMAQ/z:/M13LTsthXeADdZmMAQ/z
                                                                                                                                                              MD5:2EBA751A1ED9D254D4E8DA5ECE436158
                                                                                                                                                              SHA1:8556F3918506EC480902AC5C4B6DAE19E56EC50D
                                                                                                                                                              SHA-256:32CAC384E0361A7538ACA9B31E50FF4BBE6666A0567B062083610643351BA1FB
                                                                                                                                                              SHA-512:EDBDF5651B5CF9341D843AF982C5D14A2C53745D03F98296FD7EC5F7EAE83D172056C76B6EDDA1AA0F309B166B976D9C464CCFE5EDFFE4D828C9AB66BEA8A983
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.......;.a?.|.l.|.l.|.lk..mz|.l...lo|.l...l.|.l...la|.l...mk|.l...l{|.l-..mf|.l...mv|.l-..m]|.lv..ly|.lv..lf|.l.|.lf}.l-..m;|.l...m\|.l...m~|.l...l~|.l.|.l~|.l...m~|.lRich.|.l........................PE..L......b...........!.................b...............................................................................................................z..($...0..`z......T...........................h...@............................................text............................... ..`.rdata..............................@..@.data....?.......,..................@....rsrc...............................@..@.reloc..`z...0...|..................@..B........................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files\BitComet\tools\BitCometBHO_1.5.4.11.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):767280
                                                                                                                                                              Entropy (8bit):6.580074948779808
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:S8JeUxGFb+7HcvQ1Wlf1Si5YxyNmFatNOBiNANDybDCQ9lWuJnOP:uD+7Jc1oStNOBiNANDybDCwEgnOP
                                                                                                                                                              MD5:7455FE2A83979F90705062160F98A96D
                                                                                                                                                              SHA1:6AADE40A65871C938F168E6382B8AC7A34F46879
                                                                                                                                                              SHA-256:04CF2CBB23DA8FEC93D9D021B4ED3168AFADB4BE9F47FB7E4D209A2C41DBACA5
                                                                                                                                                              SHA-512:92AA6E78D1259144BE567AC970EE2BCA1ED27D8C343C81A21ACB7C791BA129FD491F4F066F86E22FC0B63064134663C486AFCF63AB1D352218E8FA8412859775
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........&.@.H.@.H.@.H.....E.H.I...Z.H.I.....H.I.....H.I...Y.H.@.I.i.H.I...`.H.I...A.H.I...A.H.I...A.H.Rich@.H.........PE..L...\..M...........!.................#....... .......................................n...............................}.......i...........K..............0....P...j..`&..................................@............ ......Xh..`....................text............................... ..`.rdata..(^... ...`..................@..@.data...Td.......>...p..............@....tls................................@....rsrc....K.......L..................@..@.reloc......P......................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files\BitComet\tools\BitCometService.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2682920
                                                                                                                                                              Entropy (8bit):6.8309434037236505
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:49152:k8NtOFS+g/q2/1upBe3ytP4VKpHThGZ7aM0KB4JRwTckxs8sLZ:k8NV/qloC6VKPGhB4Jz
                                                                                                                                                              MD5:AE7FBFF183FF30913EBEB38913E8CFAD
                                                                                                                                                              SHA1:545CF38E47318185E168F04A733C2E0B13119C21
                                                                                                                                                              SHA-256:F366F293905BE928918AD30A020FD369E139F64FADD4CEDFF9F9FA1E663E9065
                                                                                                                                                              SHA-512:BAF9D4EF6C607A15DC203321E3412043B446776F4E364EFDB856F804E889853BEBEEA8EA98B319ECA468E2EE8E305050205CB19F280C33427E39967E4CA9FFBA
                                                                                                                                                              Malicious:true
                                                                                                                                                              Yara Hits:
                                                                                                                                                              • Rule: JoeSecurity_PrivateLoader, Description: Yara detected PrivateLoader, Source: C:\Program Files\BitComet\tools\BitCometService.exe, Author: Joe Security
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.........)..zG..zG..zG...B..zG..zG..zG.I.C..{G.X..zG.X.ZzG.X..zG...D..zG.I.B..zG...B.kzG...C..zG.....zG.....zG..zF..{G.I.N..zG.I....zG..z..zG.I.E..zG.Rich.zG.................PE..L.....a.................L..........G}.......`....@..........................P)......N)......................................Q'...... (...............(.($...0(......h&......................h&..... h&.@............`...............................text....K.......L.................. ..`.rdata..T....`.......P..............@..@.data........p'..P...X'.............@....rsrc........ (.......'.............@..@.reloc.......0(.......'.............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files\BitComet\tools\BitCometToastsNotifier.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):171152
                                                                                                                                                              Entropy (8bit):6.5555258546929265
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:T9DO2tGd7DJGi1xc+L+/TJPrFJpiF768UIlG1BQpUmi/USZWbbkcMdh1nkfwjZ:TZFGjL+rBLYtIIlwq6WbPEA4jZ
                                                                                                                                                              MD5:E9177F102A19BF29869470ACBA3D41DE
                                                                                                                                                              SHA1:98CF7CCECD46C4B30A5F72E3A1D4DA50B8878CDD
                                                                                                                                                              SHA-256:4C106371EE676595B8D30A3CD2512D5E90C0BFAC4627379DDAA01CAFB00BC7DB
                                                                                                                                                              SHA-512:CD559158EBAC27E3BD2FB7034A9B7F7020FC0FE176DC23B688E071EFD2A14D4CBE7CDF2CB3C14FB1A38DDBDF6DF94456FA0F4FFBED82DFB2B9B421FCF338A485
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.`.c.`.c.`.w.c.i.`.w.e...`.w.d.q.`..d.r.`..c.w.`..e.Q.`.w.a.i.`.j...d.`.c.a...`..i.`.`....b.`.c...b.`..b.b.`.Richc.`.........PE..L...o.*e...............#..........................@.......................................@..................................G.......................t...(...........'..p...................@(.......&..@............................................text............................... ..`.rdata..............................@..@.data...@....`.......@..............@....rsrc................T..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files\BitComet\tools\BitCometToastsNotifier.png

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):63425
                                                                                                                                                              Entropy (8bit):7.93347703649541
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:T/x+wwtYpSnWLFimU1/gtarTj0Lw30uq0REoje2YI:bJ8Y0mUitarTgc3b9YI
                                                                                                                                                              MD5:25A04FA8C1D9FAAA604609E0636E01FD
                                                                                                                                                              SHA1:A796A2A1F3BFE2ACD2A2970FF35F81520ABD0A22
                                                                                                                                                              SHA-256:35BD169598A654BCDBBCA731E87A262773B046A215BF850F16526447FEDF18D4
                                                                                                                                                              SHA-512:C43FAF706A4308C4E49A24DAF8A7C6DE347908D9600BBF343C2E058A0F2B63B0C2AEB9152000EF2CA96BD49AAB38E4D6B28FBFA223833A4DAE959B11698C56A2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR..............x......pHYs...*...*.a.,.....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmp:CreateDate="2018-08-16T16:01:59+08:00" xmp:ModifyDate="2018-08-16T18:10:57+08:00" xmp:MetadataDate="2018-08-16T18:10:57+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:4b6f81b9-1f10-4d43-a488-584c23398961" xmpMM:DocumentID="xmp.did:4b6f81b9-1f10-4d43-a488-584c23398961" xmpMM:OriginalDo

                                                                                                                                                              C:\Program Files\BitComet\tools\ChromeExtension.crx

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:Google Chrome extension, version 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):44195
                                                                                                                                                              Entropy (8bit):7.96317691624297
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:spP35zfOMiYI0Tx9H80VEXhaF+tM8sZuLot4fEO/Yu3j/Lk73nEJsIQbxSU/+pfP:4P3/DtjCM8+uLVdguzw7ksIQdSdpfZ1r
                                                                                                                                                              MD5:B5E53CD0A433BA0F0ADB24961DB590F3
                                                                                                                                                              SHA1:7F15AF928236C6681B2B3277EA147E1B8B80CEE5
                                                                                                                                                              SHA-256:EADAE80FF23734EE06C38847222A915B199195D9CC178DFA9E0B4341BB2DBD8B
                                                                                                                                                              SHA-512:9685A147A4D26CDF25FB7303317A0F022AE52FA18AC2C8DDD82F14AE62D85265DEAD490514A6A1EA832AEEC15E4FE81FBBC5F74670F9C4029F29109432B5F23A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:Cr24..............0.."0...*.H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.|1..n.<Fb..f..*Q1.....s..2..{*.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-*eu...b...........,L%.IR.s.......8.g:.%.K(u.T.R.....@JH^M.^..!O.8....#.,.`.......4.................q.'6.....6...X....}:....."....Q:B.......qJ..mf0.....M}.R..'?...AUs..~x..:..%..H...wp..Y...38$....O!.kW......]u.l.8."O|..n...>i.c..[.g.L-.R..._>.0....S8I. ..x......0.."0...*.H.............0...........c...W@.~.#>.p....../*p..A.... .^...g.O...U...-.^"V..%+BRI...2..:_`(."z...g.B.F.u-..y..xs.7O...{....o./.....X..fW.....UfB..j."yyb..X..[...W2..1...+Wf..A.\.U...:Mj.5d..A...*Q....%)U...`.... .W...?.^KH.....,.v.T.|m%.."[..Z.W.......(...t.l.........z.k?1............$.e.,.."..S..;;...........U.t...j...g-.`L`5.4.2..q.P..i(...Q.[...T..k.......".3C.Fw!TuU..f.......`Y...

                                                                                                                                                              C:\Program Files\BitComet\tools\ChromeLauncher.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):139816
                                                                                                                                                              Entropy (8bit):6.598124286051334
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:Jfa7N3rbZF/PgE18ERTagvE15fYNrEBmAzZ+vjXnkfB:ARrVF/oEqERTadm0l9+vDkp
                                                                                                                                                              MD5:B230A1586DB0F1B1988D5DFEC70B255C
                                                                                                                                                              SHA1:FA0157968002B98429B37EBE866DEA51E80C2A32
                                                                                                                                                              SHA-256:CD1B47F4BD6C11FC72FE9F68A11E3071CFC95F18C9B672BCE65F233781A1661D
                                                                                                                                                              SHA-512:1FDEDF965909F3B15B06C7F3A73C5BFFC2BC6AED667DC0E16340DC2C9EA8E777BCD66071FB44B629A0C55D82025AEF5CDBE2D9F4BE87965A38636126C9619534
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(.e.l...l...l....,..f....,.......,..t...>...}...>...y...>...X...e..m...e..g...l...........i.......m...l...m.......m...Richl...................PE..L......b.................T.........._........p....@..........................@............@.................................X...x.......................($... ......0...p...................@...........@............p..x............................text....S.......T.................. ..`.rdata..T}...p...~...X..............@..@.data...............................@....rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files\BitComet\tools\ChromeLauncherManifest.json

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):304
                                                                                                                                                              Entropy (8bit):4.853656194965306
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:boWpMhWe/zXCORVsJdTvFFaFlLulkNCfMHMHCiChdNC+jcOY:MthzXiT5UlLAjf+ima+jHY
                                                                                                                                                              MD5:8350DC4AAC7FD59AF1154BA4C143B29D
                                                                                                                                                              SHA1:0F3DE83A11292EE8BE0D905F97132CDADD3A5353
                                                                                                                                                              SHA-256:AC1233A07ADE8B37EF7477F34B23F440FB727141AEDC6A0CC7B6CC745C453653
                                                                                                                                                              SHA-512:0EA01A7B4CA44D0A294CC93729951588914DB44F050B1902BED0013DAFE54BA8A1D27E89EB3B216E9AA8936834AAC737EF09C8239C17C3CB6EECDAAC031511BF
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.{.. "name": "com.bitcomet.chrome_extension",.. "description": "BitComet Launcher for Chrome",.. "path": "ChromeLauncher.exe",.. "type": "stdio",.. "allowed_origins": [.. "chrome-extension://dhigneefebkcagnpnpbibganpmfgebnk/",.. "chrome-extension://nomdogicfjajjjlflnlfbhekelnhklka/".. ]..}

                                                                                                                                                              C:\Program Files\BitComet\tools\EdgeExtension.crx

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:Google Chrome extension, version 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):43883
                                                                                                                                                              Entropy (8bit):7.971775583969194
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:kwe9+gTVPOBYLEVU4mSF2qXCR4QZQTVejNtJ1oa3P8RrKxV/9XpCdydj/LlFrls5:kb+gTVPO9LmSQqyR4QuojNr13+ynhva5
                                                                                                                                                              MD5:8888FD9341D582EE0A1CDC6383830696
                                                                                                                                                              SHA1:A848F22AC8292AF1C9674E1634900F2C9DC374DF
                                                                                                                                                              SHA-256:041494C0252A6222E62AE17D4E764090B9495DEECE64876C39748177CFC90BC3
                                                                                                                                                              SHA-512:A3708E4B67546A01797FD7E05DC08DF4AE00BE7767C1FFBC22EA843E1EFE604B9AB5085594BB39D7ECB790019A106ECB3A98E635BCCAC09B73D82EE14718B8BF
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:Cr24..............0.."0...*.H.............0...........(.....|.....,.mt..i1=:..u@...p.8..p/4..6Z.i....q...s....Z.H.PswF...w..M9-j....w.1..+A....o^j.....)....<...+5..$j..W..G....5.c.............|.a;./.".N(..&.=.U. .`G.....n..L.?..6.......zFO..-.....{....k....Z.?l+[..|.C.F.S.~..NIz>. .".L...0....wi........bR...YcS.e._..z..8M.ol{{xg;arS......6...A|......%.g)Sb3.Q.......2.....Q@...j...#d.~-...F.................u.}..O.-73...x...eB.....U.@P..A....W.Ze....6..`,6.}.X....`...$.>...0`.Y3]Eg.K.....R.3..~-..Y...qh.2.....y...{^V..r..i<..4.dC'.......!.o........0.."0...*.H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e..........;......l.|L..=...q>.\.T.A..r9=[0 =Bz..s....:..}.N.8).......0)&_c,.R...}....pv....Q..a....GA...7...:........or=%....d=

                                                                                                                                                              C:\Program Files\BitComet\tools\FirefoxExtension.xpi

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):50083
                                                                                                                                                              Entropy (8bit):7.944464293367564
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:jnf8DfG7z9v+5rhof00ZCSUc6mWSMsLylP9s6l:LmfGZWAs0XRLLyV9v
                                                                                                                                                              MD5:947351071B97C49CAB881C9ECB6106E4
                                                                                                                                                              SHA1:C1885744E69DEBED0CB26FC0E79221F9E74E3D52
                                                                                                                                                              SHA-256:1B26DFFAF433AA6095E481B23694E6B49CF4D7D464B771EE2783191E8E588B3E
                                                                                                                                                              SHA-512:D3ED996F6C8C6B4B5D4080FA705FCD46E892535C4A205C109C58760B01420AC84D346CB001706CBEEDEC6185709A568EC998D89B52FB197C73FC2526930BD55D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:PK............................background.js.Z[o.:.~v.....Nd.+.o...E..g..I..t....-.m"..%.\...~..$..A..D.9..p...r&.H..Y..I7..x...._.rM..F.9fsP....`$?..4W(>Q...E....`|`Y1..DQ../.W.....ys..X.I.......{.Nx..::..)g......L..9'.@dV#..*Y.W..lU)P....Ta1...N.....m4.yJ.d.*..27.La!..)......o.NF9*...P..X...z\..;q...sL([.8.n...."x.!...]............q..]A...M....l&.'.Hm...P. 7..3X".=.Ud....>...\..[.&!.=..f.=c.)Q..b...IK......,.Y...u...g.g..N...K}....H^.?...ek.z...W...u'..s,B.[t..r.}.+Q.L......~.5.....B.....8.D.5%...$k..i63.@q ...Da..,k.Sd)...(..G3.].....NY.....)#/A.i.=<V.l....j.o..~.M/'/........U...@....O...#..#..=...ES7.Vkr.z...n..@..Lb....n}Q2E.Lr"..9w-zH..h.u..2.vQo%Q.._<......IaY9w.....\9_.|.*.U.;e..;.d.a.&..wMQ.........2'....-..<.}./1.......kSn..$.H..!#gQ.a.=wI$M....o".CD..F9.L*...9_.d..v..*.&Vo"1..;5k.......f.,..L....^.........O.M...%,..u.W6....v.*( .{....&....Oh.e|`..bf...P(..N.Ye:..:....'..x...=.......f........I..N.R.j...f...Y.iN.."9.PD.r[.5l...|

                                                                                                                                                              C:\Program Files\BitComet\tools\FirefoxLauncherManifest.json

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):231
                                                                                                                                                              Entropy (8bit):4.68954356042108
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:boWpDaJAWe/zbMQVHORVsJdTvFFaF1hiDaJxKdb:M8hzoQNfT5U1hB2
                                                                                                                                                              MD5:A837F7D8FBEDB8800FD1336C14FD737E
                                                                                                                                                              SHA1:C784A3FDF5174A0D70513D390105E0228D22EA1B
                                                                                                                                                              SHA-256:94884EF7A3EC61B82AA65303A9F677EC9D5AEF1D0AA05E94A219077D8E2C9C87
                                                                                                                                                              SHA-512:61A70D4C12AEEF5C0A2EF47CAAF1E868A993A5EF685D79880BCCC7B905EB2399AE4D803A9C7C526D5B2E2A3AC6BC25880D537C7424642A85CDC2BEBDD04935D6
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.{.. "name": "com.bitcomet.firefox_extension",.. "description": "BitComet Launcher for Firefox",.. "path": "ChromeLauncher.exe",.. "type": "stdio",.. "allowed_extensions": [ "com.bitcomet.firefox_extension@bitcomet.com" ]..}

                                                                                                                                                              C:\Program Files\BitComet\tools\UPNP.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):820528
                                                                                                                                                              Entropy (8bit):6.575283923382807
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24576:uD+m1APb2/LKKcEuLXYMeyYIqDkHZRF1G:OAC/+UMeyYsHZj1G
                                                                                                                                                              MD5:FEBBAF0C03103A63E0141A96535B7745
                                                                                                                                                              SHA1:84D8DECCDCF8AE2C703063477E4788A61BA061A1
                                                                                                                                                              SHA-256:5139CA694CDBA3802811160DD15563F72B8CC1D6CE0D9CC3B415104516EAC305
                                                                                                                                                              SHA-512:B51B22C0E5E5B7805D3641F17FAC2C28DB1B5615799B6C6DDAFE3B202A59A17E25EF0441F77A6B967366C52C217BF48C2148104D2B8CC81CD363E3021C8B67E6
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$....... .d...d...d...p...a.......u..............z.......p....#!.`...6...}.......m...6...,...6...@...m.e.a...m.u.....d...t.......V.......e...d.q.e.......e...Richd...........PE..L....s.`.................b... ....... ............@..................................f....@.............................................pM...........p..0....@...p.. ...T...........................x...@............................................text....`.......b.................. ..`.rdata..~ ......."...f..............@..@.data...\=.......(..................@....rsrc...pM.......N..................@..@.reloc...p...@...r..................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files\BitComet\tools\Updater.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):726056
                                                                                                                                                              Entropy (8bit):6.492964327207684
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:SIJ9lGROd3q/52rs7zlaiWEkgjiXMzbQszKpBOI9QcjmXZ8dHe6o0t:SIJ9IY3qBss7xaiWEkj9QcjmXE+6o0t
                                                                                                                                                              MD5:391A3355B69755571AA824951ECE36C4
                                                                                                                                                              SHA1:5AA3750CCC2D48FDBF19A576D3A0BD1FFC45BBEC
                                                                                                                                                              SHA-256:4A86EF1AA69BD3E28F266D68604AFC5C5F140E17C4440A8E18EDF59E9AB13EFD
                                                                                                                                                              SHA-512:96E5775F96D662D602783DCC40DC4B52D429889FF7630BC05B54A7A05D7174154910C903CAD941DAC44A51B805819AB3CA033E13FE2BB36348F28D8942BFEB9A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 9%
                                                                                                                                                              Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......................i`f.....i`d.N...i`e...................x..........................................x.......x.h.............x.......Rich............................PE..L.....a.................&...................@....@..........................0......w........................................M..........Hh..............($...........y..8....................y......8y..@............@..h............................text....$.......&.................. ..`.rdata... ...@..."...*..............@..@.data....N...p...:...L..............@....rsrc...Hh.......j..................@..@........................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files\BitComet\tools\VideoSnapshot.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2975272
                                                                                                                                                              Entropy (8bit):6.807096842635996
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:49152:FixX45hdiI3NTpepQyhcQEsFz/AyobctPfqgI/FTDGZOkyk+5is8FDcbo:FixXe3NTpepQyhMEcyicxqg+GkkykF
                                                                                                                                                              MD5:1FA717DDEB7C00E4E92B02198F8D5634
                                                                                                                                                              SHA1:DF5815BD907737A6A40BDA3EAAC8AE2D10B5EAC8
                                                                                                                                                              SHA-256:C904F160AC09BFA5AB01475CF2565FBB7D5CFBD6C78DF87FE889C2039139B5A2
                                                                                                                                                              SHA-512:4005C1B16DDFB2BD9697970867CC5C305E1F6E6A48EDA73F1362E5CEF832B4CE59E9E3DA0D9CA62E2E7E70487A2563BFC8FFBCD450E73EA78339D5983EDBAA13
                                                                                                                                                              Malicious:true
                                                                                                                                                              Yara Hits:
                                                                                                                                                              • Rule: JoeSecurity_PrivateLoader, Description: Yara detected PrivateLoader, Source: C:\Program Files\BitComet\tools\VideoSnapshot.exe, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_PrivateLoader, Description: Yara detected PrivateLoader, Source: C:\Program Files\BitComet\tools\VideoSnapshot.exe, Author: Joe Security
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$........0P.HQ>.HQ>.HQ>....UQ>.....Q>....lQ>.\7;.MQ>.HQ>.]Q>..8:..P>..8:.\Q>.....LQ>..9=.UQ>..8;.|Q>..9;..Q>..9:.oQ>..8;.JQ>..8=.KQ>.A)..MQ>.A)..SQ>.HQ?..P>..87..Q>..8..IQ>.HQ..IQ>..8<.IQ>.RichHQ>.........................PE..L......c.....................2....................@...................................-.......................................*.......,. ............B-.($....,.</...'*.T....................(*.....h'*.@............................................text............................... ..`_TEXT64.h........................... ..`.rdata...U.......V..................@..@.data...x.... +..H....*.............@..._RDATA........,......F+.............@..@.rsrc... .....,......L+.............@..@.reloc..</....,..0....,.............@..B................................................................................................................................

                                                                                                                                                              C:\Program Files\BitComet\uninst.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1294647
                                                                                                                                                              Entropy (8bit):7.968295704859879
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24576:2An1USPa6QhDppTyqmVp1Us6BF1VtHIP1AqIevzWToYrOWg+TU0+q:X1zFM7yHbduzoPMebWUYlTz
                                                                                                                                                              MD5:CE91A202F1193A1595C91564E29DF79C
                                                                                                                                                              SHA1:727398F801215C6DD93184B472D2BD7374A0D231
                                                                                                                                                              SHA-256:34B88CA000458644EA051860CA28182AE11AD33C250626FB777F0466913ACCD2
                                                                                                                                                              SHA-512:842792AF1BBF7CC85837F46436C397FD8BD3F378EE5DEF63F5970FB6936B32ACCF957A57AE16DD70D2FBBE9B939881406E8568828B71AEEDADDC4E3C19DB411F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L...5.oZ.................f...........4............@..........................@...........@.............................................,............7...'...........................................................................................text....d.......f.................. ..`.rdata...............j..............@..@.data...X............~..............@....ndata...................................rsrc...,...........................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\analyticsmanager.cab

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Microsoft Cabinet archive data, many, 1832863 bytes, 2 files, at 0x44 +A "\analyticsmanager.dll" +A "\analyticsmanager.manifest", flags 0x4, number 1, extra bytes 20 in head, 165 datablocks, 0x1503 compression
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1854303
                                                                                                                                                              Entropy (8bit):7.999532784078179
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:49152:SaLlqwzI5AXB9KI1+gRMXFWMC0KNzI2/5y2LqZaDt:Ss25An11+g2Yzx5y2LIah
                                                                                                                                                              MD5:FC1D80CB5B8B6003A0914BB140345FFF
                                                                                                                                                              SHA1:E430047D573FB71D28E0A66AD1EBDA0CDAE94C8B
                                                                                                                                                              SHA-256:D9BE5DF2F1475C1694A5E4BFAF953286C416F2ED82127A6D4EF530F76BE90149
                                                                                                                                                              SHA-512:DDA60D3F5282C4A5894224CC231293660CB525B79BD47F9D898C709FA9C30ADA2F8D9C6362A67A03F46C33FD24E63484E5C17F634C92146F9478D11DE133149F
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:MSCF............D................................S..................@JR........X.{ .\analyticsmanager.dll.....@JR....X/{ .\analyticsmanager.manifest. ..t.,..[...> ....@B.5"....:]sZ..).\...R..*uZ.--..'.V.[]l....Y.".E....*PQ...u.I.A*.``DP..4..F..H..]."V......~...~..W..;=..-.}.L........V.7..G..R...KN6n..M...l..$-.%.I.5...M..dc(.G.C.mc7.CmOcF8S..3..V.,.......E..X..P.Q._U..........Y....3....E...t.#.Ow9.h.Z.Z...U@.........-.......]....sD\.......6.,..~v.Z.!....+........R.z.L.8N..&.o.%N?..k\\f^n%(.hh.Kvh..;..........n.XA...s.j...c..W..z...;..P........M.\]....m.oN.......7............\dLL8...{.v.w.Q..../.......f.W`.7..K..M.^..q.k..W{Z..o.Zw.....#..:....k.i.......\...N...N?....#'=w.....|...\R.=.\........0..QnU...'{/..:......33v.Y..=...u....X...<.S...._u......b'..N.4]..|s............'j.E...o.........V.)n.u..U.,...-...o........#'...k.\.N...H.:.C..C...C..{.w.?u.....;......._..;/.q..w.v...<,....+j_..,.IW.g.=..^b..6..............z..??.....3[.y........Z.

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\analyticstelemetry.cab

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Microsoft Cabinet archive data, many, 39389 bytes, 55 files, at 0x44 +A "\analyticstelemetry.manifest" +A "\context\analyticscontextconfig.luc", flags 0x4, number 1, extra bytes 20 in head, 4 datablocks, 0x1503 compression
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):60829
                                                                                                                                                              Entropy (8bit):7.912284559987157
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:N4SenpHzeUd7rkXRDXG2MfChzEqc4iFx1Y7Yxt:N4SenpHzeG7oE2BEqc4BE
                                                                                                                                                              MD5:E31F4BB0AAAC86D36FAAD2A4D0F1C5EA
                                                                                                                                                              SHA1:7A6A130DA6AB929C1E4D0AAFB101E42D9C00B7C9
                                                                                                                                                              SHA-256:ECC5F8F3E91FD5A066FA0B4198E755C97D527DE1ECBEFC8FAB8F93BA137043FB
                                                                                                                                                              SHA-512:B7C1E15E1E9E3CA962B24104BE8371BBA49C5D78DB135DE2504101CD31116ACF3640621E9ED584516FCD156FC5F9E9A5CD6A88A4A372F33B0A006CFE116C2A4B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MSCF...........D...........7...................S..........-.......Z..........X={ .\analyticstelemetry.manifest.....Z......X.w .\context\analyticscontextconfig.luc.....g......X.w .\context\analyticswpssetting.luc.....+......X.w .\context\analyticswsswps.luc.....G$.....X.w .\context\browserinformation.luc.0...U7.....X.w .\context\browserversion.luc......;.....X.w .\context\contexthandler.luc.....+=.....X.w .\context\externalutilityfunction.luc......@.....X.w .\context\featuretrackingfeature.luc......\.....X.w .\context\hashedmachineid.luc.....H`.....X.w .\context\msspstatus.luc.O....h.....X.w .\context\samrecoverable.luc.....hk.....X.w .\context\sequencenumber.luc.....pm.....X.w .\context\smarttoasting.luc.R...xp.....X.w .\context\subscriptionexpirydate.luc.R....r.....X.w .\context\subscriptionstatus.luc......w.....X.w .\context\subscriptiontype.luc.Y...6y.....X.w .\context\suitestatus.luc......|.....X.w .\context\wpssubscriptionexpirydate.luc.F...g~.....X.w .\context\wpssubscriptionst

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\balloon_safe_annotation.png

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):3166
                                                                                                                                                              Entropy (8bit):7.890916051269147
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:b/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODx7FspC:bSDZ/I09Da01l+gmkyTt6Hk8nT3KC
                                                                                                                                                              MD5:2048DF489A12C4C9E2341BEF42883205
                                                                                                                                                              SHA1:281863D9F8B8D4D0DAD62E66E35F5C96CA0155FD
                                                                                                                                                              SHA-256:DDA74B071B5869A22B327633D9641F1340EC5B913359BB389C34C44A6DB579A5
                                                                                                                                                              SHA-512:815FC1E3A2E623FEA3B13AA2BCB3895FF9DDB2A7A05E1633C83D3F647EC4A4050AF0670ED01CABA47F02A920BF6AD84191B0B03EAD1E45105DD20D302D00CCE2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR................a....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\browserhost.cab

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Microsoft Cabinet archive data, many, 1273028 bytes, 8 files, at 0x44 +A "\browserhost.exe" +A "\browserhost.manifest", flags 0x4, number 1, extra bytes 20 in head, 119 datablocks, 0x1503 compression
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1294468
                                                                                                                                                              Entropy (8bit):7.9994038054709335
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:24576:Dsq6L/hxjFxeqiKG5p/1hEfBJZsuC4v2Cfbg4iyzcSuA0O/7HT8RmB:Iq6L5x7eqYp/1hkBQuC4vBFixy97oIB
                                                                                                                                                              MD5:59F64CFA899F63BF664CBD8861524025
                                                                                                                                                              SHA1:0E2CECD0094D003D64F3583C032C7426E825D7E5
                                                                                                                                                              SHA-256:EDBB60712FCC8ABA3D2EBA755A5D08D9A336993FB50A393BBED740EB2E20D9D7
                                                                                                                                                              SHA-512:FDD33B83A80CB70C4F2BF8881A6E6881EF43D9922D3D4EF444ED31EB8FC71038B2AC607124BEB70BCCDF73F4AC055BAC97656431DCFCBBA50BD2A5A4EC74A03E
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:MSCF.....l......D............................l...S..............w...0F;........X.{ .\browserhost.exe..-..0F;....X:{ .\browserhost.manifest.f....s;....X.d .\edge.com.mcafee.webadvisor.json.e...4u;....X.d .\edge.com.mcafee.webadvisor_v2.json......v;....X.d .\webadvisor.mcafee.chrome.extension.json.L...=y;....X.d .\webadvisor.mcafee.firefox.extension.json......z;....X.d .\webadvisor_v2.mcafee.chrome.extension.json.K...,};....X.d .\webadvisor_v2.mcafee.firefox.extension.json.K.=n....[...E .....P3. "....d........E..B..A..d'.#.$:....?.P `.S.........=Nr....Ov9.. .@..='..#....Y.......;~..~..7I}.;..U@D..n.F..X6n....n...n...W{.U.&S...W....c.y..85.UB....B.X[L6v......C..n...'.\.@#..A.o.%+B"=Cz....`.. 7D4DueP...9..7....!..2m'.J...&...kXk..-..iK..^p.V..Bb.M..N.X.x.1.m...V..Y....,g.q..pc..7.%..g\..q...!...x.:b..9.n....m....\.....~.os..Os.'_....7&}.jv...?%.#'.z..oc...V...q.?tz.sf../..v...$.5.?Q.....=.3..w...Q..../..c..x.$.nd..;......^..Q.........-.....Jz.......~..m.......em..

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\browserplugin.cab

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Microsoft Cabinet archive data, many, 5067373 bytes, 2 files, at 0x44 +A "\browserplugin.manifest" +A "\e10ssaffplg.xpi", flags 0x4, number 1, extra bytes 20 in head, 183 datablocks, 0x1503 compression
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):5088813
                                                                                                                                                              Entropy (8bit):7.999213919058614
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:98304:DPRmpsj52dThuYOyYoURVZJpQmNqNRVgxrXB+xzcf/FvFWz+hN4WDQcg7r:DJmSj4qjRVZnVNqNRVuUoftv0my
                                                                                                                                                              MD5:CD28A6B5FCEF08F3C5105F9E28AD2DFC
                                                                                                                                                              SHA1:A333F496BF254BE895CE8CE56475EF725EA16AA5
                                                                                                                                                              SHA-256:33AE0CC09F1169DEF8863F041B38D91A77413ECBCDCD07E86C4E52A270E01B90
                                                                                                                                                              SHA-512:A4F5E71265E2B4FDF5D82B0182B7D093F9F04FAD249D877E2E999DFF5FB7D288FD48675BB3D7EF3024068371902617EF88799F9B371CB4581A0901F41496E23A
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:MSCF....mRM.....D...........................mRM..S.............................X;{ .\browserplugin.manifest.xU[........X.z .\e10ssaffplg.xpi.C<.o.Z..[...............*.D..]..qwwwwwpw.P.....Apw.ww#p43VE.....`.;7...... v..H.&. .....@-.0.... >.L....z...H....!.....i..@.2+..I'n6...+s..s,.....V..Q^........4.U5E.{...m.9.......$A.P.5....P...I.?......L+.2.....+._S,..j.lF#J.CJ..~..c...2K;.2.J.!..P.".......r..k.S.J3..?H........?/.............W.. ...c_..o..#D..}/....q..vf.._X.SL@.Rb.Y.../....5.]....to...u.U..|0..,...&Z.~..G....A..N.......{+......:/...W..........G....O.?....._...X.i...c..W......O...~......S../.m.....R..P.....L...=....K.V..._..........3.:c..7.....].Xcj^......(.............5m..L;.....>.}R/.}0i..p....L..i....O...H.hD..........|.2....^......o.........}..)-..8.$.L...{O.......)...~..x....................6..o................|..i.i.....n..}..l,..d.fa.X..b.YZ.`......o.~....W._..f.k]Xn.i.........L.....MF..}W..7........[....h1..........<.'..R>...a)Y..O!.g....

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\downloadscan.cab

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Microsoft Cabinet archive data, many, 2267193 bytes, 3 files, at 0x44 +A "\downloadscan.manifest" +A "\win32\downloadscan.dll", flags 0x4, number 1, extra bytes 20 in head, 202 datablocks, 0x1503 compression
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2288633
                                                                                                                                                              Entropy (8bit):7.999756011957629
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:49152:GhuB/5Tf5chrYxhYVgRy+0VsdcG9BAqfMYuRRHRWO7NO:LBduwRy++sdcGjMYaHkp
                                                                                                                                                              MD5:87493DEC109676502B6DAFC748D6C5AE
                                                                                                                                                              SHA1:38751D55C05FC9FC9F7DE62B9F8359EA0A31418E
                                                                                                                                                              SHA-256:DAE32E2BA6667C880C13A82498F67DFC0C20A72CE53030B37148E0F56E08CF7E
                                                                                                                                                              SHA-512:7031A0A192577E69C646FEC23B3CDD84BF3C2D02227FEE79C5225F3C529AD5264E644CB9C8DE924BCA377AEB55E47A3202A92ED02573702FFB505BA809363DCC
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:MSCF....9.".....D...........................9."..S.............................X8{ .\downloadscan.manifest.../........X.z .\win32\downloadscan.dll.H.5.s./....X.{ .\x64\downloadscan.dll..H..d...[...K.p..."C.$.....}..o....B...'P.QUV.....&dc"t/...{H...}d[.3.v......A >..T...B`1k....1..D.Te$#.X...p......=..{`./.......Y-.;s}.I...a...du.....R7..c .....I`y.I%....'J..Y..T.K......k...P..D.j@..J..3p_..{U..w..U./..... 4#fFgv....}?....q..z.$.wx/&....f.s[.3.b.I..d[%I..-#a...R...DA6I...p.... ..P....GC<.'...u.n.f...s.b.W.+N...R.1..KA=v..by..*...K..A.f.F~=W...y.6%..s...A.(.G.M.:.ou.%..`.......^J.X.W....n.vP...!.k.......+TPn.u[s..S?.I..V.)....~5.jET.m..E...E.X.9.W....u...VV....].....b.2.k!.k...a..&.9..j....uZk6..y...jo..f.......0..|...3....;T....<.....W.Z....i....k...S.l.}....F.g..O.S....?....w......:..............>K.w..55.px.P...(...f....(...r.#.q1.:c.'i.vk3..xk..Jg..Z.v...}..^.s.^..s.Gpp.Z._:...~P#.Z.6-(..%..e...e.2..l._t.&.S2.~...iy.vi..1..J...,.K.

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\eventmanager.cab

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Microsoft Cabinet archive data, many, 1567813 bytes, 2 files, at 0x44 +A "\eventmanager.dll" +A "\eventmanager.manifest", flags 0x4, number 1, extra bytes 20 in head, 139 datablocks, 0x1503 compression
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1589253
                                                                                                                                                              Entropy (8bit):7.999603523809742
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:24576:KfOBQwNTt4yy/psxUb0GGS3fKh9lPdoDAT73Qk2cNR+ym5x+FLv:qwVt4HexIqS3fcFo8T7AkXsynLv
                                                                                                                                                              MD5:70B7CD8E459AB45979AF9319458DCEEE
                                                                                                                                                              SHA1:325254A1979254B0496C82D51F9B4BE0C9411171
                                                                                                                                                              SHA-256:83FD850F16E9E0B75EA94A9E146F0A66D402013429C8830229B13436DC00C7F1
                                                                                                                                                              SHA-512:2FEAC64FCA0B2C85E21E231402A0651A44FF233E34E8E9037C0C7182C4916620BACC77B976B039D083FD2043D212A50FEFEC31B341A0BC7440722675369F5AD3
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:MSCF....E.......D...........................E....S..................XNE........X.{ .\eventmanager.dll.....XNE....X3{ .\eventmanager.manifest.d@...+..[...5 .....@..4..........&.i,7..,.:..ZW.3..Ygt.[.].,...V...v....u...V.)hgw..Yeus..N.........|.<..rw?y...../j....D5..H@..N...f..]....MgL.z6s...I..N..c..GJ.2.L$.rw;.....dC..1$.J.b....X"=Cz..P...U.%.. .*........U3USPP.5.ww..;[.....gjkY...y..A."|8.t.(...P...s .....t.h8....s.h....rh....Wk.is....0...........].....<....w.y.{...xn^..\..!.w..xmuU[~...._...s.....>o...U..V...ztZB......R8.].9k...wkkc...N..+.n~...7.sE.....y.y....<Z.I...9...z;...3..vt..........p...,........[.j.&........'.5.x.r...U....O..N...l..?.]..ZCO.....|._3j=.h...'...w.....)W...|k...........oq.^.i~U...;...V7....Er....tO...yQb../.>....'....?.^.^.e..^.O.k..n.K..^{.....kW.I....>.u6....~..~.....M......q..R..A;a......`.....Z.=+..:.......C...3.=...O..."......i.g.....O....:..f.}.m.;s...K..Ov..j....q.e..t.y.../+......Nj..s..._..\....-8C..i@.y.P.

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\icon_complete.png

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):3219
                                                                                                                                                              Entropy (8bit):7.7127647052020425
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:ek20QaOtG6FvySCYWm8yAxvU+LblYFv2tct:eQQaOwhS8m8yH+flLtct
                                                                                                                                                              MD5:4A09448B224F83F4E6D36AEC9FF4DA1E
                                                                                                                                                              SHA1:CC42250CAF610210EFF2904B1A08630A0888AB2F
                                                                                                                                                              SHA-256:911215D1ADA8D78A33F6ED9A3740A0652BE74EFA34ED22AE569D143F9B3B5040
                                                                                                                                                              SHA-512:390587FA96D17112CA7EC1ADFE2BA103FE39E980A35A2D4C7A3B6BCF4DE9E95B200DDCEE3C4B6C34899DE51F20F9635D41259558C77CF24279D26264DA953E2B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...d...d.....p.T....tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2014 (Macintosh)" xmpMM:InstanceID="xmp.iid:013EDEF9F71C11E4981AC0D7455F8258" xmpMM:DocumentID="xmp.did:013EDEFAF71C11E4981AC0D7455F8258"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:013EDEF7F71C11E4981AC0D7455F8258" stRef:documentID="xmp.did:013EDEF8F71C11E4981AC0D7455F8258"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>d.8.....IDATx..kL.W.....Z(....h5>J....T,...4U...h.I..&~...`..hc......"h.. X.....m...Q....%...........'..ta.

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\icon_failed.png

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):3390
                                                                                                                                                              Entropy (8bit):7.74331289225542
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:ek2J8fBtCIc5eJXe1TDiotN45Myx7n6v9+j0ZH:e98fB8vcJqVUtx+9+j0p
                                                                                                                                                              MD5:AEE9C26A50511C3E4196C28662BCE665
                                                                                                                                                              SHA1:ADF6DA6EE3EAAD88E8EF1C9C07505AEFFDE89B57
                                                                                                                                                              SHA-256:0E2904A557F79BCE71A47BFB03E49FA9C5B54C7855017B54143EA2214501BFE6
                                                                                                                                                              SHA-512:F90AA520FD9308C502B857C4425BF6CF6E12C401EA4B538534E58655448232CF797AA9A9BA60B0932DBAFC28EE925D22BED6740DF82BB02C5C99EF851389F783
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...d...d.....p.T....tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2014 (Macintosh)" xmpMM:InstanceID="xmp.iid:013EDEFDF71C11E4981AC0D7455F8258" xmpMM:DocumentID="xmp.did:013EDEFEF71C11E4981AC0D7455F8258"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:013EDEFBF71C11E4981AC0D7455F8258" stRef:documentID="xmp.did:013EDEFCF71C11E4981AC0D7455F8258"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..*.....IDATx..klTU...v..--/5.<.J...."F.aD.HQ4..(...j.P.a...?T ..F...........5..... ..jU..Q#.V(.]g...w.g.n.$.m

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\icon_laptop.png

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:PNG image data, 100 x 73, 8-bit/color RGBA, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1511
                                                                                                                                                              Entropy (8bit):7.072392857408681
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:YQ1hepWwjx82lY2T3JbVvdgqud1oUUyJ3Vnf//XPtGiLBVa470GoqF0ynT6/at8a:YuccNn2Vw7znJ3BvPtnLW5qF0yTUa6fC
                                                                                                                                                              MD5:4D3A0258CF71A406CB7669FBE3FBEB2E
                                                                                                                                                              SHA1:0811273369EADF2604DB3C53426F85FE74B785E4
                                                                                                                                                              SHA-256:C156050A5D788BAD7D8F36482072B44A23F502F23C5F9198F6EB1EB066765DEE
                                                                                                                                                              SHA-512:837A275BC63DD19F5F8553E056C5EAF257D530A54E0EC386BB28B0A515CA58929E3464612C30D9E7034ACF7473119E03B00EBAB26B220391330FEF12BC087973
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...d...I............tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2014 (Macintosh)" xmpMM:InstanceID="xmp.iid:3EBDD818F71C11E4981AC0D7455F8258" xmpMM:DocumentID="xmp.did:3EBDD819F71C11E4981AC0D7455F8258"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:013EDEFFF71C11E4981AC0D7455F8258" stRef:documentID="xmp.did:013EDF00F71C11E4981AC0D7455F8258"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..}....UIDATx..K.Q..sj-HT...X..t.Z.P.A$...v...._.-]DAkG....#.B....dr.(..@.*......-y.......<H.......{..^.\NA|h..

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\installer.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2992056
                                                                                                                                                              Entropy (8bit):6.511794279870456
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:49152:dsD9fxCnCOMl7fy3M5Ljl4H531JlYDPwazuZboZJz:aD9mCOMpfy3M5LjaZ3nzKuZUPz
                                                                                                                                                              MD5:8AEB0F3027A7666A0B4A84EF235E12D1
                                                                                                                                                              SHA1:17A59E3787819B1B01F9C692A1BBDB79B20D253D
                                                                                                                                                              SHA-256:37095D00C9EFAD040FEB959C81D3342325A8FAE0377523F48706E51DD223B082
                                                                                                                                                              SHA-512:F4C80036276C50F7B7E470FBDB83C900CC1A3C7E028573327A9D3BBF7807A26B51F0D1D3E2D40D4CC860D3E1E405925665E296C6EEB3BB43E2B1EBABD586FEAD
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.........X1.h6b.h6b.h6b..5c.h6b..3cMh6b0.2c.h6b0.5c.h6b0.3c.h6bS.3c.h6b..3c.h6b..2c.h6b..7c.h6b.h6b.h6b^.2c.h6b.h7b.j6b..?c.h6b..6c.h6b...b.h6b.h.b.h6b..4c.h6bRich.h6b........PE..d......f.........."....$.l...$......`>.........@..............................-.......-...`........................................... .$..... ......0$.8h....".PK....,.......-.....0...p.......................(...p...@..................... ......................text....j.......l.................. ..`.rdata...............p..............@..@.data...d.... !.......!.............@....pdata..PK...."..L....!.............@..@.didat........$.......".............@..._RDATA..\.... $.......".............@..@.rsrc...8h...0$..j....".............@..@.reloc........-..0...Z,.............@..B........................................................................................................................

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jquery-1.9.0.min.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:ASCII text, with very long lines (32132), with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):93205
                                                                                                                                                              Entropy (8bit):5.288224495738039
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:fYcvR3VhH37Ha7EmakRhIHASkCDy08otU6myJXXxMZyYk0AjrzCqlKDo9YhnaTdT:fY8MaW2c+UELKUqnAdiW
                                                                                                                                                              MD5:E846CE33CC80FFA0EFCA94DCBAA7B226
                                                                                                                                                              SHA1:2AA1E4486CA972CC3C0EAAB8EFB88912C332D65A
                                                                                                                                                              SHA-256:E764BC9286817A038FA9064EC80BA6CB61FC8932E000337A343B582790D11324
                                                                                                                                                              SHA-512:3013CA1AF1934F4A82E11552E6D761A31EA67AFD4088E27BED53EC2C521469875AE1EFC428609BBA6C92DD57F1E5934385043BD038C49387DAFAA00CA8960BA1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:/*! jQuery v1.9.0 | (c) 2005, 2012 jQuery Foundation, Inc. | jquery.org/license */(function(e,t){"use strict";function n(e){var t=e.length,n=st.type(e);return st.isWindow(e)?!1:1===e.nodeType&&t?!0:"array"===n||"function"!==n&&(0===t||"number"==typeof t&&t>0&&t-1 in e)}function r(e){var t=Tt[e]={};return st.each(e.match(lt)||[],function(e,n){t[n]=!0}),t}function i(e,n,r,i){if(st.acceptData(e)){var o,a,s=st.expando,u="string"==typeof n,l=e.nodeType,c=l?st.cache:e,f=l?e[s]:e[s]&&s;if(f&&c[f]&&(i||c[f].data)||!u||r!==t)return f||(l?e[s]=f=K.pop()||st.guid++:f=s),c[f]||(c[f]={},l||(c[f].toJSON=st.noop)),("object"==typeof n||"function"==typeof n)&&(i?c[f]=st.extend(c[f],n):c[f].data=st.extend(c[f].data,n)),o=c[f],i||(o.data||(o.data={}),o=o.data),r!==t&&(o[st.camelCase(n)]=r),u?(a=o[n],null==a&&(a=o[st.camelCase(n)])):a=o,a}}function o(e,t,n){if(st.acceptData(e)){var r,i,o,a=e.nodeType,u=a?st.cache:e,l=a?e[st.expando]:st.expando;if(u[l]){if(t&&(r=n?u[l]:u[l].data)){st.isArray(t)?t=t.concat(

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\eula-cs-CZ.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-16, little-endian text, with very long lines (2374), with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):74892
                                                                                                                                                              Entropy (8bit):3.810622672044098
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:MtrgKi7KxT98/9UIBtIFbxb6EFNBRV25JWavzs87n37ebyUDfIjGU:hs91bzNx0JWGsiUDw5
                                                                                                                                                              MD5:336171D852F78501F395A86C96E06F24
                                                                                                                                                              SHA1:4C9D04D51F64D672C8AF1BAF3D704E118F8124EE
                                                                                                                                                              SHA-256:6DF4FF6F669EBBF49794D43B3536A0C10804E3FC0AD5697EED4C9D1C26298F16
                                                                                                                                                              SHA-512:B2309B8C0D119C50AFF57589C02E033BE371317C11AD13712530FBC41A751C3A62B385CD288DE789FFA09D56036FA4A7E1DA607B18C70D13EDD56EA9A9212B83
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..L.i.c.e.n...n... .s.m.l.o.u.v.a. .n.a. .b.e.z.p.e...n.o.s.t.n... .s.o.f.t.w.a.r.e. .I.n.t.e.l.........D...k.u.j.e.m.e. .z.a. .v.y.u.~.i.t... .b.e.z.p.e...n.o.s.t.n...h.o. .s.o.f.t.w.a.r.u. .a. .s.l.u.~.e.b. .s.p.o.l.e...n.o.s.t.i. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n. .(.d...l.e. .j.e.n. .. S.o.f.t.w.a.r.e.. ).,. .k.t.e.r... .p.o.s.k.y.t.u.j.e. .j.e.j... .s.t.o.p.r.o.c.e.n.t.n... .v.l.a.s.t.n...n... .d.c.e.Y.i.n... .s.p.o.l.e...n.o.s.t. .M.c.A.f.e.e... .T.o.t.o. .j.e. .p.r...v.n... .u.j.e.d.n...n... .m.e.z.i. .v...m.i. .a. .n.a.a... .s.p.o.l.e...n.o.s.t..... .I.n.s.t.a.l.a.c... .n.e.b.o. .p.o.u.~.i.t...m. .S.o.f.t.w.a.r.u. .v.y.j.a.d.Y.u.j.e.t.e. .s.o.u.h.l.a.s. .s. .p.o.d.m...n.k.a.m.i. .u.j.e.d.n...n...,. .p.r.o.t.o. .s.i. .j.e. .p.e...l.i.v... .p.Y.e...t...t.e... .........T.a.t.o. .s.m.l.o.u.v.a. .n.a. .b.e.z.p.e...n.o.s.t.n... .S.o.f.t.w.a.r.e. .I.n.t.e.l. .(.d...l.e. .j.e.n. .. S.m.l.o.u.v.a.. ). .u.p.r.a.v.u.j.e. .v.a.a.e. .p.r...v.a. .k. .p.o.u.~.i.t... .S.o.f.t.w.a.r.u.,. .j.e.

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\eula-da-DK.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-16, little-endian text, with very long lines (2582), with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):91776
                                                                                                                                                              Entropy (8bit):3.4527085220928413
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:nVNCGgfhrLJT5kmiYjC8DZ9p7WmTg5MSItM7Q1cTm/diaa8mwQUIqetIHi7M6X6k:nVNCGgfhpTziY2Ol7FtD0aa8mWe9+P2
                                                                                                                                                              MD5:B131D7E8FE9EE2C4E2F43FA6E1DBFF54
                                                                                                                                                              SHA1:CB02A022A05EA570807A97372E6D65B7411A7ECA
                                                                                                                                                              SHA-256:792494F4705035860F85BFCDD40DF2427FBF6C26BBE88A5EF5FD42E81B0C8E8A
                                                                                                                                                              SHA-512:3C50F11A47606BA8CC282BA5D32FBC69E6B3227CD8025877DB3B899BD6D661EE0410B05CFF9F0E09FE30950E4530B3F23D3CE4EF0415D9E87D80447994B77757
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..L.i.c.e.n.s.a.f.t.a.l.e. .f.o.r. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........T.a.k.,. .f.o.r.d.i. .d.u. .b.r.u.g.e.r. .I.n.t.e.l. .S.e.c.u.r.i.t.y.s. .s.o.f.t.w.a.r.e. .o.g. .t.j.e.n.e.s.t.e.r. .(.".S.o.f.t.w.a.r.e.n.".).,. .d.e.r. .l.e.v.e.r.e.s. .a.f. .M.c.A.f.e.e.,. .s.o.m. .e.r. .e.t. .h.e.l.e.j.e.t. .d.a.t.t.e.r.s.e.l.s.k.a.b. .a.f. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .D.e.t.t.e. .e.r. .e.n. .j.u.r.i.d.i.s.k. .a.f.t.a.l.e. .m.e.l.l.e.m. .o.s. .. .i.n.s.t.a.l.l.a.t.i.o.n. .e.l.l.e.r. .o.p.r.e.t.t.e.l.s.e. .a.f. .a.d.g.a.n.g. .t.i.l. .v.o.r.e.s. .S.o.f.t.w.a.r.e. .b.e.t.y.d.e.r.,. .a.t. .d.u. .a.c.c.e.p.t.e.r.e.r. .d.i.s.s.e. .v.i.l.k...r.,. .s... .d.u. .b.e.d.e.s. .l...s.e. .d.e.m. .o.m.h.y.g.g.e.l.i.g.t... .........I. .d.e.n.n.e. .l.i.c.e.n.s.a.f.t.a.l.e. .f.r.a. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.".A.f.t.a.l.e.n.".). .g.e.n.n.e.m.g...s. .d.i.n.e. .r.e.t.t.i.g.h.e.d.e.r. .t.i.l. .a.t. .b.r.u.g.e. .S.o.f.t.w.a.r.e.n.,. .b.e.g.r...n.s.n.i.n.g.e.r. .f.o.r. .d.e.n.n.e. .b.r.u.g.,. .v.o.r.

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\eula-de-DE.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-16, little-endian text, with very long lines (3216), with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):104206
                                                                                                                                                              Entropy (8bit):3.4917909026152407
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:Sw8jufxOksgk9WB2s9JIEwSKjKmDwwy0U6QVMsaXSTLgaP3FGA:FahQV1
                                                                                                                                                              MD5:824E01AFB20389C910DEDA17DB604E25
                                                                                                                                                              SHA1:E7C27B62203669A76FE2497F5B0B0B53304CADC2
                                                                                                                                                              SHA-256:D1DD1079005041A8F623DEC55B3AF3F40E74B54126DB24298E0B4546633025AD
                                                                                                                                                              SHA-512:B56DD4D3BDAE27067AEB8766A66EC1A5247D0B104506DB39B84E1E8DEB7C9D6F2F28F2476525CA98366AEBAA59B091A68078DB8F901D697449EFB4E7705DB977
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..I.n.t.e.l. .S.e.c.u.r.i.t.y. .L.i.z.e.n.z.v.e.r.t.r.a.g.........V.i.e.l.e.n. .D.a.n.k.,. .d.a.s.s. .S.i.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .S.o.f.t.w.a.r.e. .u.n.d. .D.i.e.n.s.t.e. .(.. S.o.f.t.w.a.r.e.. ). .n.u.t.z.e.n.,. .d.i.e. .v.o.n. .M.c.A.f.e.e.,. .e.i.n.e.r. .h.u.n.d.e.r.t.p.r.o.z.e.n.t.i.g.e.n. .T.o.c.h.t.e.r.g.e.s.e.l.l.s.c.h.a.f.t. .v.o.n. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n.,. .b.e.r.e.i.t.g.e.s.t.e.l.l.t. .w.e.r.d.e.n... .D.i.e.s. .i.s.t. .e.i.n. .r.e.c.h.t.s.k.r...f.t.i.g.e.r. .V.e.r.t.r.a.g. .z.w.i.s.c.h.e.n. .u.n.s.. m.i.t. .d.e.r. .I.n.s.t.a.l.l.a.t.i.o.n. .o.d.e.r. .d.e.m. .Z.u.g.r.i.f.f. .a.u.f. .u.n.s.e.r.e. .S.o.f.t.w.a.r.e. .s.t.i.m.m.e.n. .S.i.e. .d.i.e.s.e.n. .B.e.d.i.n.g.u.n.g.e.n. .z.u... .L.e.s.e.n. .S.i.e. .s.i.e. .d.e.s.h.a.l.b. .b.i.t.t.e. .a.u.f.m.e.r.k.s.a.m. .d.u.r.c.h... .........D.i.e.s.e.r. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .L.i.z.e.n.z.v.e.r.t.r.a.g. .(.. V.e.r.t.r.a.g.. ). .u.m.f.a.s.s.t. .I.h.r.e. .R.e.c.h.t.e. .z.u.r. .N.u.t.z.u.n.g. .d.e.r. .S.o.f.t.

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\eula-el-GR.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-16, little-endian text, with very long lines (2776), with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):103714
                                                                                                                                                              Entropy (8bit):4.054440424705962
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:7NPKnckk7Va7/ZYluLyBO/mw5rMpNVjX7MYeFz8cT:lKB5rMdX4/j
                                                                                                                                                              MD5:F2C064F11014D95AED438A06E2F41B71
                                                                                                                                                              SHA1:EB6DDE54992588C72ADA6907A6DD2E7882E64B8A
                                                                                                                                                              SHA-256:4E77401EDEB3848E31ECA311AB4AF1A7D89853973A3D327401CAA940EF4F8D40
                                                                                                                                                              SHA-512:AC7302BE570B017C638DC96AD3434FEFD2D7C0250282EC86458C61A5FBC9DBD07F9B79BBC7892D52DB06E8658CA1419716173F8D2CCAC990DA4920EC9E8C9555
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:................ ............. ............. ..................... ....... ................... .I.n.t.e.l. .S.e.c.u.r.i.t.y............... ......................... ....... ............................. ................... ....... ................... .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.. ................... ).,. ....... ............... ... .M.c.A.f.e.e.,. ....... ....................... ..................... ................... ....... .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... ... ............... ................. ....... ............. ................. ............... ..... ......... ....... .......... .. ....................... ... ..................... ....... ..................... ....... ....................... ....... ..................... ..... ......... ................. ...........,. ................. ....... ....................... ..... ......... ................... ....................... ........... ............... ............... ............. ............. .....................

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\eula-en-US.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-16, little-endian text, with very long lines (2456), with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):85990
                                                                                                                                                              Entropy (8bit):3.4535050949611015
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:/F7Fw4sT8hXmsqSrobeIT6f9BMaR4EYtI7F5K:ao6
                                                                                                                                                              MD5:D5F04A48AAF3CADC8323595AA794289F
                                                                                                                                                              SHA1:8280EC788F0D135E138C3AC358FB2E40272DC5CC
                                                                                                                                                              SHA-256:62BDF385B24A550665AF5B1FE02EA405F60F5ED6A009C7B59C2003D7C7BCE306
                                                                                                                                                              SHA-512:09CB4EF1D8A363FA929AA85AC787F63D62A55613C26492549C152D8B25A02463264B21AD8DA1050B8A24E4DFB11EFAE5B81DECAC301D653A38E1A4F1C4014855
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:..I.n.t.e.l. .S.e.c.u.r.i.t.y. .L.i.c.e.n.s.e. .A.g.r.e.e.m.e.n.t.........T.h.a.n.k. .y.o.u. .f.o.r. .u.s.i.n.g. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .s.o.f.t.w.a.r.e. .a.n.d. .s.e.r.v.i.c.e.s. .(.. S.o.f.t.w.a.r.e.. ).,. .p.r.o.v.i.d.e.d. .b.y. .M.c.A.f.e.e.,. .a. .w.h.o.l.l.y. .o.w.n.e.d. .s.u.b.s.i.d.i.a.r.y. .o.f. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .T.h.i.s. .i.s. .a. .l.e.g.a.l. .a.g.r.e.e.m.e.n.t. .b.e.t.w.e.e.n. .u.s.. i.n.s.t.a.l.l.i.n.g. .o.r. .a.c.c.e.s.s.i.n.g. .o.u.r. .S.o.f.t.w.a.r.e. .m.e.a.n.s. .y.o.u. .a.r.e. .a.g.r.e.e.i.n.g. .t.o. .t.h.e.s.e. .t.e.r.m.s.,. .s.o. .p.l.e.a.s.e. .r.e.a.d. .t.h.e.m. .c.a.r.e.f.u.l.l.y... .........T.h.i.s. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .L.i.c.e.n.s.e. .A.g.r.e.e.m.e.n.t. .(.. A.g.r.e.e.m.e.n.t.. ). .c.o.v.e.r.s. .y.o.u.r. .r.i.g.h.t.s. .t.o. .u.s.e. .t.h.e. .S.o.f.t.w.a.r.e.,. .r.e.s.t.r.i.c.t.i.o.n.s. .o.n. .t.h.a.t. .u.s.e.,. .o.u.r. .r.i.g.h.t. .t.o. .a.u.t.o.m.a.t.i.c.a.l.l.y. .r.e.n.e.w. .a.n.d. .c.h.a.r.g.e. .y.o.u. .f.o.r. .p.a.i.d. .v.

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\eula-es-ES.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-16, little-endian text, with very long lines (2904), with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):100834
                                                                                                                                                              Entropy (8bit):3.4281676373019536
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:JgO+5MfF+qvVWjB19FUUl2whazC7vT/yFjaX5Q9+5SYALxacixm44ri7qYdZ+vQk:Jg/5R9WPzzC3cix5kzYdZ+vQNQOU
                                                                                                                                                              MD5:48D7744204F6647FB127A1C5BA6BA815
                                                                                                                                                              SHA1:EA38E2C8E9EE80618D35C39ACBFFBAB98D607467
                                                                                                                                                              SHA-256:C3B0CB21EEAAD59B228C558529FD30EB9D7B2A53F6E96B60A7799F2DE8CDC325
                                                                                                                                                              SHA-512:0F4E6AACE0D55487E2557CA14187C80E98F2667A02381C9480DC1726C7984A35E0EEE31E31D3ACC35FCD485A58E64C08413924FC08533249A4BD6078223A469A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..A.c.u.e.r.d.o. .d.e. .l.i.c.e.n.c.i.a. .d.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........G.r.a.c.i.a.s. .p.o.r. .u.t.i.l.i.z.a.r. .l.o.s. .s.e.r.v.i.c.i.o.s. .y. .e.l. .s.o.f.t.w.a.r.e. .d.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.. S.o.f.t.w.a.r.e.. ).,. .s.u.m.i.n.i.s.t.r.a.d.o.s. .p.o.r. .M.c.A.f.e.e.,. .u.n.a. .f.i.l.i.a.l. .p.a.r.t.i.c.i.p.a.d.a. .p.l.e.n.a.m.e.n.t.e. .p.o.r. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .E.s.t.e. .e.s. .u.n. .a.c.u.e.r.d.o. .l.e.g.a.l. .e.n.t.r.e. .n.o.s.o.t.r.o.s... .A.l. .i.n.s.t.a.l.a.r. .o. .a.c.c.e.d.e.r. .a. .n.u.e.s.t.r.o. .S.o.f.t.w.a.r.e. .i.n.d.i.c.a. .u.s.t.e.d. .q.u.e. .a.c.e.p.t.a. .l.o.s. .p.r.e.s.e.n.t.e.s. .t...r.m.i.n.o.s.,. .p.o.r. .l.o. .t.a.n.t.o.,. .l.e. .r.o.g.a.m.o.s. .q.u.e. .l.o.s. .l.e.a. .c.o.n. .a.t.e.n.c.i...n... .........E.l. .p.r.e.s.e.n.t.e. .A.c.u.e.r.d.o. .d.e. .l.i.c.e.n.c.i.a. .d.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.e.l. . .. A.c.u.e.r.d.o.. ). .e.s.t.a.b.l.e.c.e. .c.u...l.e.s. .s.o.n. .s.u.s. .d.e.r.e.c.h.o.s. .d.e. .u.s.o. .d.e.

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\eula-es-MX.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-16, little-endian text, with very long lines (2904), with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):100834
                                                                                                                                                              Entropy (8bit):3.428202844789828
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:JgO+5MfF+qvVWjB19FUUl2whazC7vT/yFjaX5Q9+5SYALxacixm44ri7qYdZ+vQa:Jg/5R9WPzzC3cix5kzYdZ+vQNQOq
                                                                                                                                                              MD5:DE90D47D0E1B037F64AE0FF4746371FE
                                                                                                                                                              SHA1:72C9CE8F6C3C6538B3BB307D7ABC5E6F08C95DDC
                                                                                                                                                              SHA-256:AF261F015505CF5B1EE581B7D5E3C28EBCC2D13A55E3E16978279110A973D8BD
                                                                                                                                                              SHA-512:3A6DC3B4F401D81B4503BF80555859C8A68C3BF336D84120532428455F620396E30A44FC1C6D0A48A32D36B28CF01AE4AB7DA2435C493614F0A807B34367067D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..A.c.u.e.r.d.o. .d.e. .l.i.c.e.n.c.i.a. .d.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........G.r.a.c.i.a.s. .p.o.r. .u.t.i.l.i.z.a.r. .l.o.s. .s.e.r.v.i.c.i.o.s. .y. .e.l. .s.o.f.t.w.a.r.e. .d.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.. S.o.f.t.w.a.r.e.. ).,. .s.u.m.i.n.i.s.t.r.a.d.o.s. .p.o.r. .M.c.A.f.e.e.,. .u.n.a. .f.i.l.i.a.l. .p.a.r.t.i.c.i.p.a.d.a. .p.l.e.n.a.m.e.n.t.e. .p.o.r. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .E.s.t.e. .e.s. .u.n. .a.c.u.e.r.d.o. .l.e.g.a.l. .e.n.t.r.e. .n.o.s.o.t.r.o.s... .A.l. .i.n.s.t.a.l.a.r. .o. .a.c.c.e.d.e.r. .a. .n.u.e.s.t.r.o. .S.o.f.t.w.a.r.e. .i.n.d.i.c.a. .u.s.t.e.d. .q.u.e. .a.c.e.p.t.a. .l.o.s. .p.r.e.s.e.n.t.e.s. .t...r.m.i.n.o.s.,. .p.o.r. .l.o. .t.a.n.t.o.,. .l.e. .r.o.g.a.m.o.s. .q.u.e. .l.o.s. .l.e.a. .c.o.n. .a.t.e.n.c.i...n... .........E.l. .p.r.e.s.e.n.t.e. .A.c.u.e.r.d.o. .d.e. .l.i.c.e.n.c.i.a. .d.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.e.l. . .. A.c.u.e.r.d.o.. ). .e.s.t.a.b.l.e.c.e. .c.u...l.e.s. .s.o.n. .s.u.s. .d.e.r.e.c.h.o.s. .d.e. .u.s.o. .d.e.

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\eula-fi-FI.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-16, little-endian text, with very long lines (2621), with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):90558
                                                                                                                                                              Entropy (8bit):3.450146543472157
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:HE2oXLv8VtIG4O4mPf5lC66AlB1Fd+NlLVlbH2ZuWUh/F:Hl4gtI24cf5c6J7l8vWUht
                                                                                                                                                              MD5:39C88A9461DE8090A174D38C7F6F9767
                                                                                                                                                              SHA1:FC5A4BDCCD9CE9D278DCBC3300ED15684EE4CB64
                                                                                                                                                              SHA-256:515F01A7F03846D41988B31E73F7D12BCF2686A9EB25124D128A0489AEC2E358
                                                                                                                                                              SHA-512:C32F6F4C71D8E9C6C0343BCAD27F8528BD21B1BA32851E9D9D586979946E1983C09C2AAA04F0E52E36EF71573DC4E82FEF0DB9ACB37D30A472270D765DDAAAF6
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..I.n.t.e.l. .S.e.c.u.r.i.t.y.n. .k...y.t.t...o.i.k.e.u.s.s.o.p.i.m.u.s.........K.i.i.t.o.s.,. .e.t.t... .v.a.l.i.t.s.i.t. .I.n.t.e.l. .S.e.c.u.r.i.t.y.n. .o.h.j.e.l.m.i.s.t.o.n. .j.a. .p.a.l.v.e.l.u.t. .(.. o.h.j.e.l.m.i.s.t.o.. ).,. .j.o.t.k.a. .t.a.r.j.o.a.a. .M.c.A.f.e.e.,. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n.i.n. .k.o.k.o.n.a.a.n. .o.m.i.s.t.a.m.a. .t.y.t...r.y.h.t.i..... .T...m... .o.n. .l.a.i.l.l.i.n.e.n. .s.o.p.i.m.u.s. .m.e.i.d...n. .j.a. .k...y.t.t...j...n. .v...l.i.l.l..... .A.s.e.n.t.a.m.a.l.l.a. .t.a.i. .k...y.t.t...m...l.l... .o.h.j.e.l.m.i.s.t.o.a.m.m.e. .s.i.t.o.u.d.u.t. .n...i.h.i.n. .e.h.t.o.i.h.i.n.,. .j.o.t.e.n. .o.n. .t...r.k.e.....,. .e.t.t... .l.u.e.t. .n.e. .h.u.o.l.e.l.l.i.s.e.s.t.i... .........T...m... .I.n.t.e.l. .S.e.c.u.r.i.t.y.n. .k...y.t.t...o.i.k.e.u.s.s.o.p.i.m.u.s. .(.. s.o.p.i.m.u.s.. ). .p.i.t..... .s.i.s...l.l.....n. .k...y.t.t...j...n. .o.i.k.e.u.d.e.t. .o.h.j.e.l.m.i.s.t.o.n. .k...y.t.t.....n.,. .t...t... .k...y.t.t..... .k.o.s.k.e.v.a.t. .r.a.j.o.

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\eula-fr-CA.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-16, little-endian text, with very long lines (2833), with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):100074
                                                                                                                                                              Entropy (8bit):3.457040131949318
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:YUojrJ1ucLHrQIvVQXrsE2Kd6kPu1dTNjOy+psORpT6koBWT7qO6H5U8mSwE9NeO:YwrsE2KdYmfwqjlK2BZVqCChcw0Zi
                                                                                                                                                              MD5:3FF786DB5D4723D746180364B580FAC7
                                                                                                                                                              SHA1:A26927F22CB4A7E399EDAD33EBBD53DCD8B80A24
                                                                                                                                                              SHA-256:B1404602B3C9CAFEE9F6FF3C90BC87F198A875A03550E3C68F43E4D6F75EAB4E
                                                                                                                                                              SHA-512:EB333F9DBF8A9747030F97BD4FF5F96B75F9573570B167F017B18D7A70F7F5A2148F3AB1FA15EFFD027B533807F1BA6E64FFC76A5321EBC535F60EF4D9401BB3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..C.o.n.t.r.a.t. .d.e. .l.i.c.e.n.c.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........M.e.r.c.i. .d.'.u.t.i.l.i.s.e.r. .l.e. .l.o.g.i.c.i.e.l. .e.t. .l.e.s. .s.e.r.v.i.c.e.s. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.....L.o.g.i.c.i.e.l.....). .f.o.u.r.n.i.s. .p.a.r. .M.c.A.f.e.e.,. .u.n.e. .f.i.l.i.a.l.e. .e.n. .p.r.o.p.r.i...t... .e.x.c.l.u.s.i.v.e. .d.'.I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .L.e. .p.r...s.e.n.t. .d.o.c.u.m.e.n.t. .e.s.t. .u.n. .a.c.c.o.r.d. .j.u.r.i.d.i.q.u.e. .c.o.n.c.l.u. .e.n.t.r.e. .v.o.u.s. .e.t. .n.o.u.s... .E.n. .i.n.s.t.a.l.l.a.n.t. .o.u. .e.n. .a.c.c...d.a.n.t. ... .n.o.t.r.e. .L.o.g.i.c.i.e.l.,. .v.o.u.s. .a.c.c.e.p.t.e.z. .l.e.s. .p.r...s.e.n.t.e.s. .c.o.n.d.i.t.i.o.n.s... .V.e.u.i.l.l.e.z. .d.o.n.c. .l.e.s. .l.i.r.e. .a.t.t.e.n.t.i.v.e.m.e.n.t... .........L.e. .p.r...s.e.n.t. .C.o.n.t.r.a.t. .d.e. .L.i.c.e.n.c.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.....C.o.n.t.r.a.t.....). .p.o.r.t.e. .s.u.r. .v.o.s. .d.r.o.i.t.s. .d.'.u.t.i.l.i.s.e.r. .l.e. .L.o.g.i.c.i.e.l.,. .l.e.s. .r.e.s.

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\eula-fr-FR.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-16, little-endian text, with very long lines (2833), with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):100074
                                                                                                                                                              Entropy (8bit):3.4568050428280013
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:YUojrJ1ucLHrQIvVQXrsE2Kd6kPu1dTNjOy+psORpT6koBWT7qO6H5U8mSwE9NeI:YwrsE2KdYmfwqjlK2BZVqCChcw0M3
                                                                                                                                                              MD5:892B094312674EAB1AB1CC454E26776E
                                                                                                                                                              SHA1:C99E53F00AC320215DC8FA5504F880867599581D
                                                                                                                                                              SHA-256:05244FA9688C3B32522A0CEF507949A547DCD37AB7F1D0CE8081142866FFFEE1
                                                                                                                                                              SHA-512:C905696BE8C10773E821F73398B7495583A7C1E6F06D2E0FAE4994FDB70AF533B42E7C1B6E376D66B28B65568EFE21FDBCA612178D679F73D8DCA4ED81E9C7A7
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..C.o.n.t.r.a.t. .d.e. .l.i.c.e.n.c.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........M.e.r.c.i. .d.'.u.t.i.l.i.s.e.r. .l.e. .l.o.g.i.c.i.e.l. .e.t. .l.e.s. .s.e.r.v.i.c.e.s. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.....L.o.g.i.c.i.e.l.....). .f.o.u.r.n.i.s. .p.a.r. .M.c.A.f.e.e.,. .u.n.e. .f.i.l.i.a.l.e. .e.n. .p.r.o.p.r.i...t... .e.x.c.l.u.s.i.v.e. .d.'.I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .L.e. .p.r...s.e.n.t. .d.o.c.u.m.e.n.t. .e.s.t. .u.n. .a.c.c.o.r.d. .j.u.r.i.d.i.q.u.e. .c.o.n.c.l.u. .e.n.t.r.e. .v.o.u.s. .e.t. .n.o.u.s... .E.n. .i.n.s.t.a.l.l.a.n.t. .o.u. .e.n. .a.c.c...d.a.n.t. ... .n.o.t.r.e. .L.o.g.i.c.i.e.l.,. .v.o.u.s. .a.c.c.e.p.t.e.z. .l.e.s. .p.r...s.e.n.t.e.s. .c.o.n.d.i.t.i.o.n.s... .V.e.u.i.l.l.e.z. .d.o.n.c. .l.e.s. .l.i.r.e. .a.t.t.e.n.t.i.v.e.m.e.n.t... .........L.e. .p.r...s.e.n.t. .C.o.n.t.r.a.t. .d.e. .L.i.c.e.n.c.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.....C.o.n.t.r.a.t.....). .p.o.r.t.e. .s.u.r. .v.o.s. .d.r.o.i.t.s. .d.'.u.t.i.l.i.s.e.r. .l.e. .L.o.g.i.c.i.e.l.,. .l.e.s. .r.e.s.

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\eula-hr-HR.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-16, little-endian text, with very long lines (2677), with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):87744
                                                                                                                                                              Entropy (8bit):3.5880101596727054
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:4D5AY14mQom+cQuoy8H5Zo3ij63ydrXxYM+gDUC5lBvt4UgmsiyePIOd:3jelDB1vz
                                                                                                                                                              MD5:81210B302C97A99A0C2662D1049F7957
                                                                                                                                                              SHA1:4A841250EEA113D7BF43DFB3FE0AC9B8AC3A823C
                                                                                                                                                              SHA-256:FD978BDE7ED35937805D297DEE38437A8C63183C7539D3221A20DD55048A4A67
                                                                                                                                                              SHA-512:A74E41B04470A3933F1B3F74706142D179DA65DA5DA174A3606C415F33CD253E9542CFEAB027D4979274250CB2C3D872CBFB4C8F4E6D96E7A696F4DDFA028859
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..L.i.c.e.n.c.n.i. .u.g.o.v.o.r. .z.a. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........H.v.a.l.a. .a.t.o. .k.o.r.i.s.t.i.t.e. .s.o.f.t.v.e.r. .i. .u.s.l.u.g.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.".S.o.f.t.v.e.r.".).,. .k.o.j.i. .i.s.p.o.r.u...u.j.e. .M.c.A.f.e.e.,. .p.o.d.r.u.~.n.i.c.a. .u. .p.o.t.p.u.n.o.m. .v.l.a.s.n.i.a.t.v.u. .t.v.r.t.k.e. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .O.v.o. .j.e. .p.r.a.v.n.i. .u.g.o.v.o.r. .i.z.m.e...u. .n.a.s.. i.n.s.t.a.l.i.r.a.n.j.e. .i.l.i. .p.r.i.s.t.u.p. .n.a.a.e.m. .S.o.f.t.v.e.r.u. .z.n.a...i. .d.a. .s.e. .s.l.a.~.e.t.e. .s. .n.j.e.g.o.v.i.m. .u.v.j.e.t.i.m.a.,. .p.a. .v.a.s. .m.o.l.i.m.o. .d.a. .i.h. .p.a.~.l.j.i.v.o. .p.r.o...i.t.a.t.e... .........O.v.a.j. .L.i.c.e.n.c.n.i. .u.g.o.v.o.r. .z.a. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.".U.g.o.v.o.r.".). .o.b.u.h.v.a...a. .v.a.a.e. .p.r.a.v.o. .n.a. .k.o.r.i.a.t.e.n.j.e. .S.o.f.t.v.e.r.a.,. .o.g.r.a.n.i...e.n.j.a. .u. .n.j.e.g.o.v.o.m. .k.o.r.i.a.t.e.n.j.u.,. .n.a.a.e. .p.r.a.v.o. .n.a. .a.u.t.o.m.a.t.s.k.o. .o.b.n.

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\eula-hu-HU.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-16, little-endian text, with very long lines (2782), with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):98690
                                                                                                                                                              Entropy (8bit):3.6858895529892832
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:3+Y5qMxXdv62/0ojFC0hQY+eUbM5wbg6u+sWOvm1SeWN3CBw4bZKMoBwAbCxpI1j:zsGDmMe6
                                                                                                                                                              MD5:C94686AA230DAEEDDC89ADC110527D6B
                                                                                                                                                              SHA1:CCE7EFACA897A9E591053FBB1607A910C64CAD1C
                                                                                                                                                              SHA-256:A60081C8325EEB19F3F6BFF90A8FC394A37A60A60A9597D12A8970C4A6C6BB66
                                                                                                                                                              SHA-512:811FBC6D5FA5C114A1AAD5BCBEBD371DBEC3C3AC9FC3F10C765E55B5A4E1DF61951C0AEE2672F541FE9DC09A934D9312E287C70FEB59B12F6B93B9D31996739C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..I.n.t.e.l. .S.e.c.u.r.i.t.y. .l.i.c.e.n.c.s.z.e.r.z.Q.d...s.........K...s.z...n.j...k.,. .h.o.g.y. .a.z. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n. .t.e.l.j.e.s. .t.u.l.a.j.d.o.n... .l.e...n.y.v...l.l.a.l.a.t.a.,. .a. .M.c.A.f.e.e. ...l.t.a.l. .k...n...l.t. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .s.z.o.f.t.v.e.r.t. ...s. .s.z.o.l.g...l.t.a.t...s.o.k.a.t. .(.. S.z.o.f.t.v.e.r.. ). .h.a.s.z.n...l.j.a... .E.z. .a. .l.i.c.e.n.c.s.z.e.r.z.Q.d...s. .e.g.y. .k...z...t.t...n.k. .l...t.r.e.j...t.t. .j.o.g.i. .m.e.g...l.l.a.p.o.d...s. .. .a. .S.z.o.f.t.v.e.r...n.k. .t.e.l.e.p...t...s.e. .v.a.g.y. .a. .S.z.o.f.t.v.e.r...n.k.h...z. .v.a.l... .h.o.z.z...f...r...s. .a.z.t. .j.e.l.e.n.t.i.,. .h.o.g.y. ...n. .e.g.y.e.t...r.t. .a. .s.z.e.r.z.Q.d...s.b.e.n. .f.o.g.l.a.l.t. .f.e.l.t...t.e.l.e.k.k.e.l.,. .e.z...r.t. .o.l.v.a.s.s.a. .e.l. .f.i.g.y.e.l.m.e.s.e.n. .a.z.o.k.a.t... .........A.z. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .l.i.c.e.n.c.s.z.e.r.z.Q.d...s. .(.. S.z.e.r.z.Q.d...s.. ). .a. .S.z.o.f.t.v.e.r. .h.a.s.z.n...l.a.

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\eula-it-IT.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-16, little-endian text, with very long lines (2974), with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):103642
                                                                                                                                                              Entropy (8bit):3.4107374870794307
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:D+piF3I9T9qL1rEINLBC7LcfZJJSMqHDYCebssNKlU8rmjVHJkItVdM1OrzjO:6/c16yjdM1OC
                                                                                                                                                              MD5:81F4E9639A0B7520221336DE6B3E9BFC
                                                                                                                                                              SHA1:68470C1962BBDD8EEA0F1587094D52AE4BBE7139
                                                                                                                                                              SHA-256:426A1B3912BB12C9094C92A9F907BB5B097A07945A4825E81577A67EB207F869
                                                                                                                                                              SHA-512:5ABB4B1751CE550068A0A8D9A6C9542E2992FFF1D6F07B20AEF13FA3840A35EB94D57635C0536D523B34A0E576E3ABA6B49F21287EEB7BBE03FF1A23C260C36F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..C.o.n.t.r.a.t.t.o. .d.i. .l.i.c.e.n.z.a. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........G.r.a.z.i.e. .p.e.r. .a.v.e.r. .s.c.e.l.t.o. .d.i. .u.t.i.l.i.z.z.a.r.e. .i. .s.o.f.t.w.a.r.e. .e. .i. .s.e.r.v.i.z.i. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.".S.o.f.t.w.a.r.e.".). .f.o.r.n.i.t.i. .d.a. .M.c.A.f.e.e.,. .c.o.n.s.o.c.i.a.t.a. .i.n.t.e.r.a.m.e.n.t.e. .c.o.n.t.r.o.l.l.a.t.a. .d.i. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .I.l. .p.r.e.s.e.n.t.e. .d.o.c.u.m.e.n.t.o. .c.o.s.t.i.t.u.i.s.c.e. .u.n. .c.o.n.t.r.a.t.t.o. .l.e.g.a.l.e. .t.r.a. .n.o.i. .e. .l.'.u.t.e.n.t.e... .L.'.i.n.s.t.a.l.l.a.z.i.o.n.e. .o. .l.'.a.c.c.e.s.s.o. .a.i. .n.o.s.t.r.i. .S.o.f.t.w.a.r.e. .i.m.p.l.i.c.a. .l.'.a.c.c.e.t.t.a.z.i.o.n.e. .d.i. .q.u.e.s.t.i. .t.e.r.m.i.n.i. .d.a. .p.a.r.t.e. .d.e.l.l.'.u.t.e.n.t.e.,. .c.h.e. .p.e.r.t.a.n.t.o. ... .t.e.n.u.t.o. .a. .l.e.g.g.e.r.l.i. .c.o.n. .a.t.t.e.n.z.i.o.n.e... .........I.l. .p.r.e.s.e.n.t.e. .c.o.n.t.r.a.t.t.o. .d.i. .l.i.c.e.n.z.a. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.".C.o.n.t.r.a.t.t.o.

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\eula-ja-JP.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-16, little-endian text, with very long lines (1234), with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41412
                                                                                                                                                              Entropy (8bit):5.771952945025147
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:8bY257pwJE0xJUhghf/3Gkojyef4ktbfR/KSCDpKIb5MhOj:8E257OJE0ighfSyKtbfxap7
                                                                                                                                                              MD5:EA88916DDF44AF0D8B830086F4F15177
                                                                                                                                                              SHA1:4B0496E918AFADFE789AC6C36EA59D87C0F9BBC8
                                                                                                                                                              SHA-256:4841EBF00BC628C28BF9CE86C90A1538E52FCE8E5269D2CD371A82A301F1932E
                                                                                                                                                              SHA-512:ACC8C940FA6699FDE3F908801FF275AA669ED5A847E3B7AB5369F276C796A4023FA0B52AB4308D2717B25C3B0151FB219EA035C45811FE27B09E970B17CAA896
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..I.n.t.e.l. .S.e.c.u.r.i.t.y. ..O(u1...QY.}........I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n. .n0hQM..Q.P[.O>yg0B0.0 .M.c.A.f.e.e.L0.c.OY0.0 .I.n.t.e.l. .S.e.c.u.r.i.t.y. ..0.0.0.0.0.0J0.0s0.0.0.0.0...0.0.0.0.0.0.0.0...0)R(uD0_0`0M0B0.0L0h0F0T0V0D0~0Y0.0 .,gQY.}o0J0.[.ih0S_>yh0n0..k0.}P}U0.0.0.l.vj0QY.}g0Y0.0J0.[.io0.0S_>yn0.0.0.0.0.0.0.0.0.0.0.0.0.0~0_0o0]0.0k0.0.0.0.0Y0.0S0h0k0.0.0.0,gQY.}n0ag.Nk0.T.aW0_0h0.0j0U0.0~0Y0n0g0.0,gQY.}.0.0O0J0...0O0`0U0D0.0 .........S0n0 .I.n.t.e.l. .S.e.c.u.r.i.t.y. ..O(u1...QY.}.f...0,gQY.}.0..o0.0J0.[.in0.0.0.0.0.0.0.O(u)j.0.O(u6RP..0.0.0.0.0.0.0n0.g.Q.0.0.0.0.0~0_0o0_j...0..R.vk0.f.eJ0.0s0...Y0.0S_>yn0)j)R.0J0.0s0S_>yh0J0.[.in0..k0zv.uY0.0.S..'`n0B0.0.}.Nn0.N..k0.[Y0.0J0.[.in0.T.ak0d0D0f0....W0f0D0~0Y0.0 ....j0.0,gQY.}h0h0.0k0J0.[.ik0i.(uU0.0.0.0S_>yn0.0.0.0.0.0.0k0..Y0.0.X.f..h.t.t.p.s.:././.w.w.w...m.c.a.f.e.e...c.o.m./.c.o.m.m.o.n./.p.r.i.v.a.c.y./.j.a.p.a.n.e.s.e./.i.n.d.e.x...h.t.m....0+T.0...Rag.Nx0n0.0.0.0L0+T~0.0f0D0~0Y0.0 ..T.Vyr.gn0ag.No0,gQY.}

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\eula-ko-KR.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-16, little-endian text, with very long lines (1439), with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):46328
                                                                                                                                                              Entropy (8bit):5.585794700750028
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:iLBTRAz/+e7qDm/7QgTt2Bk6baOLFureI5mIxFRlKi3ly:iLnAz/+e+DmzQgZ2BdblJsSi3ly
                                                                                                                                                              MD5:0D4572C42A4701FCB0970457B8F1DEE6
                                                                                                                                                              SHA1:532FA7429E62020C717F0D757770E5F9B6516974
                                                                                                                                                              SHA-256:8F12AC9C9D9D051C906747F09C7B5CE7E0ADC414627840ED187C878581934095
                                                                                                                                                              SHA-512:CEDB66FD02B5CFBA02C70B1CDFF394937D85341AC40117D36D1B8147BFC5A3EC576FAE9284060B22316F8DC0219DC61E1285509F21596C660EF5E95F6B58202F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..I.n.t.e.l. .S.e.c.u.r.i.t.y. .|.t. ... ..}.........I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n.X. ...a. .... .....x. .M.c.A.f.e.e..... .....X.. .I.n.t.e.l. .S.e.c.u.r.i.t.y. ......... ... ...D...(.t.X. .. ......... ).|. .....t. ...T... .....i..... .t..@. .....@. ...... ...t.X. ..... ..}...... .....X. .........|. .$.X.X.p... .a.8...X.. ...@. .t. ..}. .}..... ..X.X.. ...t...\.,. .}...D. ...X. .J... .}.<...0. ......... .........t. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .|.t. ... ..}.(.t.X. .. .}.. ).@. ......... ..... .....,. ......... .....X. ...\. .p.t.,. .........X. . .. .....t.. .0..... ...t. ....<.\. ..}.D. .1...X.. ......... ...a.D. ...l.`. ... .... .....X. .....,. ...... .....@. ...... ...t... .....`. ... .... .....X. ...... ...\. ...X.X. ..X. .....D. ........ .t. .8...... ...X.... ........ .t. ..... ..}.D. .l.1.X.. .\. .....x. ....\. ..... ..}. .}...(...:. ...x.......8. .H..8.,. .(.h.t.t.p.s.:././.w.w.w...m.c.a.f.e.e...c.o.m./.c.o.m.m.o.n./.

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\eula-nb-NO.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-16, little-endian text, with very long lines (2743), with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):84476
                                                                                                                                                              Entropy (8bit):3.446888866125506
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:fvk22xFWKEjm1iM70NJnqNiGAsX0MRKQ/s+p6jdIuRMPNGZJq7ALa/jcuqqRp5QS:fvk22xFWKEjm1iM70NJnqNiGAsX0MRKQ
                                                                                                                                                              MD5:97AE90F728820E24506E10DCDE92B3AF
                                                                                                                                                              SHA1:BC23A7D82498CD3A6B44641606FDC3024F87F671
                                                                                                                                                              SHA-256:6D878B1F980F78003078E6670CF07156A4D8AAF83007B108BEE203C8CED19523
                                                                                                                                                              SHA-512:A29DA1088FCE94C320590771B75B1243E5320B0604F61BC8AFEABCA5465ABFD028C72F60891F554AA2D90666C789CC5BCC1ECC8342FE7F9D97863C9514AFB03C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..L.i.s.e.n.s.a.v.t.a.l.e. .f.o.r. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........T.a.k.k. .f.o.r. .a.t. .d.u. .b.r.u.k.e.r. .I.n.t.e.l. .S.e.c.u.r.i.t.y.s. .p.r.o.g.r.a.m.v.a.r.e. .o.g. .t.j.e.n.e.s.t.e.r. .(.".p.r.o.g.r.a.m.m.e.t.).,. .l.e.v.e.r.t. .a.v. .M.c.A.f.e.e.,. .e.t. .h.e.l.e.i.d. .d.a.t.t.e.r.s.e.l.s.k.a.p. .a.v. .I.n.t.e.r. .C.o.r.p.o.r.a.t.i.o.n... .D.e.t.t.e. .e.r. .e.n. .j.u.r.i.d.i.s.k. .a.v.t.a.l.e. .m.e.l.l.o.m. .o.s.s. .. .i.n.s.t.a.l.l.a.s.j.o.n. .e.l.l.e.r. .b.r.u.k. .a.v. .v...r. .p.r.o.g.r.a.m.v.a.r.e. .b.e.t.y.r. .a.t. .d.u. .g.o.d.t.a.r. .d.i.s.s.e. .v.i.l.k...r.e.n.e.,. .s... .l.e.s. .d.e.m. .n...y.e... .........D.e.n.n.e. .l.i.s.e.n.s.a.v.t.a.l.e.n. .f.o.r. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.".a.v.t.a.l.e.n.".). .d.e.k.k.e.r. .d.i.n. .r.e.t.t. .t.i.l. ... .b.e.n.y.t.t.e. .p.r.o.g.r.a.m.v.a.r.e.n.,. .b.e.g.r.e.n.s.n.i.n.g.e.r. .p... .d.e.n.n.e. .b.r.u.k.e.n.,. .v...r. .r.e.t.t. .t.i.l. .a.u.t.o.m.a.t.i.s.k. .f.o.r.n.y.e.l.s.e. .o.g. .t.a. .b.e.t.a.l.t. .f.o.r. .b.e.t.a.

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\eula-nl-NL.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-16, little-endian text, with very long lines (2801), with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):100578
                                                                                                                                                              Entropy (8bit):3.4424837948953178
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:OQ/9KbnOOfNlk/R5OVUR5Oh/RKe/HEUnOZVOsf6jzytJpjIzGeQRV22n3sT58jQq:L
                                                                                                                                                              MD5:6288D5FBB1E8177FC978C245CC88B6DD
                                                                                                                                                              SHA1:5E7DDC0BFE06C81EEFF585DCEEF5E9D141463D6B
                                                                                                                                                              SHA-256:ED8D9156A3E639C037631340ACBF4BFF1EFD8052AACBB4328405DCC7B5300D40
                                                                                                                                                              SHA-512:E0B11D46A385CEF9B4965014B62C4A751AAC2134DF088639B0F16F8E7E82E56D6435A8CDEEEE78CA2F4399A765D4E3A1C91FD2DAE67EA0C992E04A74DADCB2B7
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..L.i.c.e.n.t.i.e.o.v.e.r.e.e.n.k.o.m.s.t. .v.a.n. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........D.a.n.k. .u. .v.o.o.r. .h.e.t. .g.e.b.r.u.i.k. .v.a.n. .I.n.t.e.l. .S.e.c.u.r.i.t.y.-.s.o.f.t.w.a.r.e. .e.n. .-.d.i.e.n.s.t.e.n. .(.'.S.o.f.t.w.a.r.e.'.).,. .a.a.n.g.e.b.o.d.e.n. .d.o.o.r. .M.c.A.f.e.e.,. .e.e.n. .v.o.l.l.e.d.i.g.e. .d.o.c.h.t.e.r.o.n.d.e.r.n.e.m.i.n.g. .v.a.n. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .D.i.t. .i.s. .e.e.n. .j.u.r.i.d.i.s.c.h.e. .o.v.e.r.e.e.n.k.o.m.s.t. .t.u.s.s.e.n. .o.n.s... .D.o.o.r. .o.n.z.e. .S.o.f.t.w.a.r.e. .t.e. .i.n.s.t.a.l.l.e.r.e.n. .e.n. .t.e. .o.p.e.n.e.n.,. .g.e.e.f.t. .u. .a.a.n. .d.a.t. .u. .a.k.k.o.o.r.d. .g.a.a.t. .m.e.t. .d.e.z.e. .v.o.o.r.w.a.a.r.d.e.n... .L.e.e.s. .z.e. .d.u.s. .z.o.r.g.v.u.l.d.i.g... .........D.e.z.e. .L.i.c.e.n.t.i.e.o.v.e.r.e.e.n.k.o.m.s.t. .v.a.n. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.'.O.v.e.r.e.e.n.k.o.m.s.t.'.). .b.e.s.c.h.r.i.j.f.t. .u.w. .r.e.c.h.t.e.n. .o.m. .d.e. .S.o.f.t.w.a.r.e. .t.e. .g.e.b.r.u.i.k.e.n.,. .d.e. .b.e.p.e.r.

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\eula-pl-PL.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-16, little-endian text, with very long lines (2967), with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):101850
                                                                                                                                                              Entropy (8bit):3.733524469823738
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:dnEmLzXswPaPfzO8liJQIKQ42HzLMH7scwS3/80GIrKQ+Q/:ayXe7
                                                                                                                                                              MD5:0FEB1AC488814E236E407AB8E480E9D2
                                                                                                                                                              SHA1:4197E1969F347A992B907D249E28727C7D48DC47
                                                                                                                                                              SHA-256:4E9CC4939A4C2F6066996481B29D9463513E88BCA617E2A9A8B2A81A7E35C61E
                                                                                                                                                              SHA-512:9621DD40C8A3E1D45226F0159D07C09E480F2CC12654FEC7A2408B1B93247576260432E6BC2CFC5BB875F1B667E15CB543E2E99145949DC2D32F1841779D0941
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..U.m.o.w.a. .l.i.c.e.n.c.y.j.n.a. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........D.z.i...k.u.j.e.m.y. .z.a. .k.o.r.z.y.s.t.a.n.i.e. .z. .o.p.r.o.g.r.a.m.o.w.a.n.i.a. .i. .u.s.B.u.g. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.z.w.a.n.y.c.h. .d.a.l.e.j. .. O.p.r.o.g.r.a.m.o.w.a.n.i.e.m.. ). .o.f.e.r.o.w.a.n.y.c.h. .p.r.z.e.z. .M.c.A.f.e.e.,. .s.p...B.k... .z.a.l.e.|.n...,. .k.t...r.e.j. .w.y.B...c.z.n.y.m. .w.B.a.[.c.i.c.i.e.l.e.m. .j.e.s.t. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .N.i.n.i.e.j.s.z.y. .d.o.k.u.m.e.n.t. .s.t.a.n.o.w.i. .u.m.o.w... .p.r.a.w.n... .m.i...d.z.y. .n.a.m.i. .a. .U.|.y.t.k.o.w.n.i.k.i.e.m. .. .z.a.i.n.s.t.a.l.o.w.a.n.i.e. .n.a.s.z.e.g.o. .O.p.r.o.g.r.a.m.o.w.a.n.i.a. .l.u.b. .u.z.y.s.k.a.n.i.e. .d.o. .n.i.e.g.o. .d.o.s.t...p.u. .j.e.s.t. .r...w.n.o.z.n.a.c.z.n.e. .z. .z.a.a.k.c.e.p.t.o.w.a.n.i.e.m. .n.i.n.i.e.j.s.z.y.c.h. .w.a.r.u.n.k...w.,. .w. .z.w.i...z.k.u. .z. .c.z.y.m. .p.r.o.s.i.m.y. .o. .u.w.a.|.n.e. .z.a.p.o.z.n.a.n.i.e. .s.i... .z. .t.r.e.[.c.i... .d.o.k.u.m.e.n.t.u... ...

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\eula-pt-BR.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-16, little-endian text, with very long lines (2603), with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):91306
                                                                                                                                                              Entropy (8bit):3.465471001248338
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:f8Wc1lp2b6cXQJ6rHcTCGXPF3zzhTOJpy0WlLyd5S+tKIbTw3ZurbNlar+wHmCYr:f7HceS+3bTrb/R6mdyGR
                                                                                                                                                              MD5:51844AF38EE7DB690940F310B0D2EE10
                                                                                                                                                              SHA1:11EC0CE80FCA957ABA73ECEACC85C53079CC9D61
                                                                                                                                                              SHA-256:F6FBB5EC51F8B9D3597B8FB36AEB6967564DD65BA02AAE75C1968C8BAD9E0076
                                                                                                                                                              SHA-512:20176F989814C43E30A414635FF0237D2880ED72C191D15E05010592B059501A306DE393908ACEEAF71767CF5F7BC1D1483B07DB81A887F2AC428B1F01C33719
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..C.o.n.t.r.a.t.o. .d.e. .L.i.c.e.n...a. .d.o. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........A.g.r.a.d.e.c.e.m.o.s. .p.o.r. .u.t.i.l.i.z.a.r. .o. .s.o.f.t.w.a.r.e. .e. .o.s. .s.e.r.v.i...o.s. .d.o. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.".S.o.f.t.w.a.r.e.".).,. .f.o.r.n.e.c.i.d.o. .p.e.l.a. .M.c.A.f.e.e.,. .u.m.a. .s.u.b.s.i.d.i...r.i.a. .i.n.t.e.g.r.a.l. .d.a. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .E.s.t.e. ... .u.m. .c.o.n.t.r.a.t.o. .l.e.g.a.l. .e.n.t.r.e. .n...s.:. .a.o. .i.n.s.t.a.l.a.r. .o.u. .a.c.e.s.s.a.r. .n.o.s.s.o. .S.o.f.t.w.a.r.e.,. .s.i.g.n.i.f.i.c.a. .a. .s.u.a. .c.o.n.c.o.r.d...n.c.i.a. .c.o.m. .e.s.t.e.s. .t.e.r.m.o.s.,. .d.e. .f.o.r.m.a. .q.u.e. .v.o.c... .d.e.v.e. .l...-.l.o.s. .c.o.m. .a. .m...x.i.m.a. .a.t.e.n.....o... .........E.s.t.e. .C.o.n.t.r.a.t.o. .d.e. .L.i.c.e.n...a. .d.o. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.".C.o.n.t.r.a.t.o.".). .c.o.b.r.e. .s.e.u.s. .d.i.r.e.i.t.o.s. .d.e. .u.t.i.l.i.z.a.....o. .d.o. .S.o.f.t.w.a.r.e.,. .r.e.s.t.r.i.....e.s. .a. .e.s.s.e. .u.s.o.,. .o. .

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\eula-pt-PT.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-16, little-endian text, with very long lines (2536), with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):96486
                                                                                                                                                              Entropy (8bit):3.4742808551160156
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:GfDawY1TqufUqhbQGb0jiATGoeQmiBKTVIsFd4:2Det6
                                                                                                                                                              MD5:F6B54C7934A81B0C5BB22E5CF687FBA8
                                                                                                                                                              SHA1:3EE9270C16B54A9CB3FD0367BDCBBF62CF2A406E
                                                                                                                                                              SHA-256:49084E5FBA6D72AB99F4F8DFA3F9D1E8EFD6E7E9E5E8C93C0DD6D00BCF729B0E
                                                                                                                                                              SHA-512:6BC280A7A0B490133F3D8E4FC1C21F345ED452DC6B9685780B69FD78A4E399A3D6652D030930666F88440614A0B83F499972C7B3D0318D9955630DD0BDBC2349
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..C.o.n.t.r.a.t.o. .d.e. .L.i.c.e.n...a. .d.a. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........O.b.r.i.g.a.d.o. .p.o.r. .u.t.i.l.i.z.a.r. .o. .s.o.f.t.w.a.r.e. .e. .o.s. .s.e.r.v.i...o.s. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.. S.o.f.t.w.a.r.e.. ). .f.o.r.n.e.c.i.d.o.s. .p.e.l.a. .M.c.A.f.e.e.,. .u.m.a. .s.u.b.s.i.d.i...r.i.a. .t.o.t.a.l.m.e.n.t.e. .d.e.t.i.d.a. .p.e.l.a. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .E.s.t.e. .d.o.c.u.m.e.n.t.o. .c.o.n.s.i.s.t.e. .n.u.m. .c.o.n.t.r.a.t.o. .l.e.g.a.l. .e.n.t.r.e. .a.m.b.a.s. .a.s. .p.a.r.t.e.s.. a.o. .i.n.s.t.a.l.a.r. .o.u. .a.o. .a.c.e.d.e.r. .a.o. .n.o.s.s.o. .S.o.f.t.w.a.r.e. .e.s.t... .a. .c.o.n.c.o.r.d.a.r. .c.o.m. .o.s. .p.r.e.s.e.n.t.e.s. .t.e.r.m.o.s.,. .p.o.r. .i.s.s.o.,. .l.e.i.a.-.o.s. .a.t.e.n.t.a.m.e.n.t.e... .........O. .p.r.e.s.e.n.t.e. .C.o.n.t.r.a.t.o. .d.e. .L.i.c.e.n...a. .d.o. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.. C.o.n.t.r.a.t.o.. ). .i.n.c.l.u.i. .o.s. .s.e.u.s. .d.i.r.e.i.t.o.s. .d.e. .u.t.i.l.i.z.a.....o. .d.o. .S.o.f.t.w.a.r.e.,. .r.e.s.

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\eula-ru-RU.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-16, little-endian text, with very long lines (2934), with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):105274
                                                                                                                                                              Entropy (8bit):3.92549890662229
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:Zrlkl/OV57V/gTNKukdeCNCaM2sJCX7Zh7Ft7yvFsknxFFNZ6AJTaFkke2bnMBqR:JfRpOEZhc8LSQ0PnmEI
                                                                                                                                                              MD5:0F5A1CA0F14E9864DD69094A0DBFD754
                                                                                                                                                              SHA1:444D5FD8D7C645C04A11859E94DB274E09761617
                                                                                                                                                              SHA-256:BAF8ECAF9B33B9A03ECA21E5BF83FB5A54E3A28A1B4406ABD830631F01329900
                                                                                                                                                              SHA-512:7321934752DE797B8A752A200CEC618B67A4ABB8A57811CA65FE48F90612A307D214445BDEC36B10ED06858AFE0B0BE24302B9BCF433B422560D2E5034498F68
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:....8.F.5.=.7.8.>.=.=.>.5. .A.>.3.;.0.H.5.=.8.5. .4.;.O. .?.@.>.3.@.0.<.<.=.>.3.>. .>.1.5.A.?.5.G.5.=.8.O. .I.n.t.e.l. .S.e.c.u.r.i.t.y...........;.0.3.>.4.0.@.8.<. ...0.A. .7.0. .8.A.?.>.;.L.7.>.2.0.=.8.5. .?.@.>.3.@.0.<.<.=.>.3.>. .>.1.5.A.?.5.G.5.=.8.O. .8. .A.;.C.6.1. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(."...@.>.3.@.0.<.<.=.>.5. .>.1.5.A.?.5.G.5.=.8.5.".).,. .?.@.5.4.>.A.B.0.2.;.O.5.<.K.E. .:.>.<.?.0.=.8.5.9. .M.c.A.f.e.e. .. .4.>.G.5.@.=.5.9. .:.>.<.?.0.=.8.5.9.,. .=.0.E.>.4.O.I.5.9.A.O. .2. .?.>.;.=.>.9. .A.>.1.A.B.2.5.=.=.>.A.B.8. .:.>.@.?.>.@.0.F.8.8. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... ...0.=.=.K.9. .4.>.:.C.<.5.=.B. .?.@.5.4.A.B.0.2.;.O.5.B. .N.@.8.4.8.G.5.A.:.>.5. .A.>.3.;.0.H.5.=.8.5. .<.5.6.4.C. .=.0.<.8... .#.A.B.0.=.>.2.:.0. .8.;.8. .4.>.A.B.C.?. .:. .=.0.H.5.<.C. ...@.>.3.@.0.<.<.=.>.<.C. .>.1.5.A.?.5.G.5.=.8.N. .>.1.>.7.=.0.G.0.N.B. ...0.H.5. .A.>.3.;.0.A.8.5. .A. .C.A.;.>.2.8.O.<.8. .M.B.>.3.>. .A.>.3.;.0.H.5.=.8.O.,. .?.>.M.B.>.<.C. .2.=.8.<.0.B.5.;.L.=.>. .>.7.=.0.:.

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\eula-sk-SK.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-16, little-endian text, with very long lines (2701), with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):89572
                                                                                                                                                              Entropy (8bit):3.7335750091559907
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:plH9miYwq9hpeKK283X97rpcvXctx1qDQDupSMeylm5Wq0FGQueLS9FpSzvFgxSX:pPfqU7AcD1/DmDqOrS9FpkXvaGOtd0
                                                                                                                                                              MD5:74F775937C5143897A9CF44BFBEFD902
                                                                                                                                                              SHA1:77A02467F4F1B5C102061845D213FB522B98527E
                                                                                                                                                              SHA-256:72D749AAC4006DAD69E79B0EA1AC98FFE3F8B6BE80E1A70713FC3E815EE28393
                                                                                                                                                              SHA-512:80C61793F344C1923AEE66DA561761633767538B812A37B9BCD6ADD32A0116DDA1F90F4A1B540B35A36883ABAB3F6C1FC5196F88C03849407767C85966130B74
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..L.i.c.e.n...n... .z.m.l.u.v.a. .I.n.t.e.l. .S.e.c.u.r.i.t.y...........a.k.u.j.e.m.e. .v...m. .z.a. .p.o.u.~...v.a.n.i.e. .s.o.f.t.v...r.u. .a. .s.l.u.~.i.e.b. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.. S.o.f.t.v...r.. ).,. .p.o.s.k.y.t.o.v.a.n...c.h. .s.p.o.l.o...n.o.s.e.o.u. .M.c.A.f.e.e.,. .k.t.o.r... .j.e. .d.c...r.s.k.o.u. .s.p.o.l.o...n.o.s.e.o.u. ...p.l.n.e. .v.l.a.s.t.n.e.n.o.u. .s.p.o.l.o...n.o.s.e.o.u. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .T.o.t.o. .j.e. .p.r...v.n.a. .z.m.l.u.v.a. .m.e.d.z.i. .n.a.m.i. .. .i.n.a.t.a.l...c.i.o.u. .a.l.e.b.o. .p.r...s.t.u.p.o.v.a.n...m. .k. .n...a.m.u. .S.o.f.t.v...r.u. .s...h.l.a.s...t.e. .s. .t...m.i.t.o. .p.o.d.m.i.e.n.k.a.m.i.,. .t.a.k.~.e. .s.i. .i.c.h.,. .p.r.o.s...m.,. .p.o.z.o.r.n.e. .p.r.e.....t.a.j.t.e... .........T...t.o. .L.i.c.e.n...n... .z.m.l.u.v.a. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(...a.l.e.j. .l.e.n. .. Z.m.l.u.v.a.. ). .s.a. .v.z.e.a.h.u.j.e. .n.a. .v.a.a.e. .p.r...v.a. .n.a. .p.o.u.~...v.a.n.i.e. .S.o.f.t.v...r.u.,. .o.b.m.e.d.z.e.

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\eula-sr-Latn-CS.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-16, little-endian text, with very long lines (2634), with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):88356
                                                                                                                                                              Entropy (8bit):3.5776709975249332
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:1PXzqxuAlAEnb93roW/JxeTYZ9/sn7/87/FXoQEHVX/Z0S/jj:dWVkTmR1+
                                                                                                                                                              MD5:65334D599E589E3CEAA2686C1282DC0A
                                                                                                                                                              SHA1:CBF88386A237399186A0DD152E6672D94F68CC8E
                                                                                                                                                              SHA-256:888DE86180A8A84A260BE1C251BD22D3A537B2FCC5F9D4C1227075034FF3ED97
                                                                                                                                                              SHA-512:68CA5DCDD94724F675976F979339E0ED4A9C8FD054212A88BBB91A4C66C545F37B23F519E1776B2003291F72EA2A930F1F4F07270E183245F32A3C4004D89550
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..U.g.o.v.o.r. .o. .l.i.c.e.n.c.i.r.a.n.j.u. .k.o.m.p.a.n.i.j.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........H.v.a.l.a. .v.a.m. .a.t.o. .k.o.r.i.s.t.i.t.e. .s.o.f.t.v.e.r. .i. .u.s.l.u.g.e. .k.o.m.p.a.n.i.j.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.. S.o.f.t.v.e.r.. ).,. .k.o.j.i. .o.b.e.z.b.e...u.j.e. .k.o.m.p.a.n.i.j.a. .M.c.A.f.e.e.,. .p.o.d.r.u.~.n.i.c.a. .u. .p.o.t.p.u.n.o.m. .v.l.a.s.n.i.a.t.v.u. .k.o.m.p.a.n.i.j.e. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .O.v.o. .j.e. .p.r.a.v.n.i. .u.g.o.v.o.r. .i.z.m.e...u. .n.a.s. .. .i.n.s.t.a.l.i.r.a.n.j.e. .n.a.a.e.g. .S.o.f.t.v.e.r.a. .i.l.i. .p.r.i.s.t.u.p.a.n.j.e. .n.j.e.m.u. .z.n.a...i. .d.a. .p.r.i.h.v.a.t.a.t.e. .o.v.e. .u.s.l.o.v.e.,. .p.a. .i.h. .s.t.o.g.a. .p.a.~.l.j.i.v.o. .p.r.o...i.t.a.j.t.e... .........O.v.a.j. .U.g.o.v.o.r. .o. .l.i.c.e.n.c.i.r.a.n.j.u. .k.o.m.p.a.n.i.j.e. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.. U.g.o.v.o.r.. ). .p.o.k.r.i.v.a. .v.a.a.a. .p.r.a.v.a. .d.a. .k.o.r.i.s.t.i.t.e. .S.o.f.t.v.e.r.,. .o.g.r.a.n.i...e.n.j.a. .t.o.g. .k.

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\eula-sv-SE.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-16, little-endian text, with very long lines (2632), with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):89704
                                                                                                                                                              Entropy (8bit):3.5035974870940803
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:dcFeHhjwanoMWVOjxKI+psB/YgpnuIbVGmD:WFCwKWsQgpz
                                                                                                                                                              MD5:530A139504F4482ADC0542CDAF995E0C
                                                                                                                                                              SHA1:A1E2D68E213B282064370720DC075953A31A9B7D
                                                                                                                                                              SHA-256:80B9EEC8050DA803CE8B422A2CBD8DD2CC8015A45B281CC09B89F2571B9B2A29
                                                                                                                                                              SHA-512:038581EEEDF5F629E096D96C28607E2A37DCC659B6F60A48506E308F6826A9368D673D17F271FA0561FC23511BD2F983B618D1F81D3E01E64C7D5C2457B860C5
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..L.i.c.e.n.s.a.v.t.a.l. .f...r. .I.n.t.e.l. .S.e.c.u.r.i.t.y.........T.a.c.k. .f...r. .a.t.t. .d.u. .a.n.v...n.d.e.r. .p.r.o.g.r.a.m.v.a.r.a.n. .o.c.h. .t.j...n.s.t.e.r.n.a. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.. P.r.o.g.r.a.m.v.a.r.a.n.. ). .f.r...n. .M.c.A.f.e.e.,. .e.t.t. .h.e.l...g.t. .d.o.t.t.e.r.b.o.l.a.g. .t.i.l.l. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .N...r. .d.u. .i.n.s.t.a.l.l.e.r.a.r. .e.l.l.e.r. .a.n.v...n.d.e.r. .P.r.o.g.r.a.m.v.a.r.a.n. .g.o.d.k...n.n.e.r. .d.u. .a.u.t.o.m.a.t.i.s.k.t. .v.i.l.l.k.o.r.e.n.,. .s... .l...s. .n.o.g.a. .i.g.e.n.o.m. .d.e.m. .f...r.s.t... .D.e.t.t.a. ...r. .e.t.t. .b.i.n.d.a.n.d.e. .j.u.r.i.d.i.s.k.t. .a.v.t.a.l. .o.s.s. .e.m.e.l.l.a.n... .........D.e.t.t.a. .L.i.c.e.n.s.a.v.t.a.l. .f...r. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .(.. A.v.t.a.l.e.t.. ). .r.e.g.l.e.r.a.r. .d.i.n.a. .r...t.t.i.g.h.e.t.e.r. .i. .s.a.m.b.a.n.d. .m.e.d. .a.n.v...n.d.n.i.n.g. .a.v. .P.r.o.g.r.a.m.v.a.r.a.n.,. .e.v.e.n.t.u.e.l.l.a. .b.e.g.r...n.s.n.i.n.g.a.r. .i. .a.n.v...n.d.n.i.

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\eula-tr-TR.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-16, little-endian text, with very long lines (2527), with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):89572
                                                                                                                                                              Entropy (8bit):3.7626865518160293
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:U4WLetFwU8STnnWH0I9fkl7+JaRtbJHGdnC2vJfPI9n9AkllkhZBYziG/xJd8oSd:UjLetFwbSTnnWH0IdkN+JaRt0dnC2xI8
                                                                                                                                                              MD5:FF416FC6239846BF727294A7A7199E58
                                                                                                                                                              SHA1:33BB13CA74C8962F7490853EB6F0E117EAFC67DF
                                                                                                                                                              SHA-256:5B26274814DF6657519C52173568003BA96A8F2E0A9486875EF11351DB630FAE
                                                                                                                                                              SHA-512:34BE9403B9C4FA5C28A578B2C73B42EE303E010981CFBCA9AD020ED9B36B7C9E70B16B7F8D0C5EC81C6B83FC9D0563059A9F10E830DA3234913F460E2EC631E4
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..I.n.t.e.l. .S.e.c.u.r.i.t.y. .L.i.s.a.n.s. .S...z.l.e._.m.e.s.i.........I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n.. 1.n. .y...z.d.e. .y...z. .i._.t.i.r.a.k.i. .o.l.a.n. .M.c.A.f.e.e. .t.a.r.a.f.1.n.d.a.n. .s.a...l.a.n.a.n. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .y.a.z.1.l.1.m.1. .v.e. .h.i.z.m.e.t.l.e.r.i.n.i. .(.. Y.a.z.1.l.1.m.. ). .k.u.l.l.a.n.d.1...1.n.1.z. .i...i.n. .t.e._.e.k.k...r. .e.d.e.r.i.z... .Y.a.z.1.l.1.m.1.m.1.z.1.n. .k.u.r.m.a.n.1.z. .v.e.y.a. .Y.a.z.1.l.1.m.1.m.1.z.a. .e.r.i._.i.m. .s.a...l.a.m.a.n.1.z. .a.r.a.m.1.z.d.a.k.i. .b.u. .y.a.s.a.l. .s...z.l.e._.m.e.n.i.n. .i.l.g.i.l.i. .h...k...m.l.e.r.i.n.i. .k.a.b.u.l. .e.t.t.i...i.n.i.z. .a.n.l.a.m.1.n.a. .g.e.l.e.c.e...i.n.d.e.n.,. .l...t.f.e.n. .b.u.n.l.a.r.1. .d.i.k.k.a.t.l.i.c.e. .o.k.u.y.u.n... .........0._.b.u. .I.n.t.e.l. .S.e.c.u.r.i.t.y. .L.i.s.a.n.s. .S...z.l.e._.m.e.s.i. .(.. S...z.l.e._.m.e.. ). .Y.a.z.1.l.1.m.1.n. .k.u.l.l.a.n.1.l.m.a.s.1.n.a. .i.l.i._.k.i.n. .h.a.k.l.a.r.1.n.1.z.1.,. .s...z. .k.o.n.u.s.u. .k.u.l.l.a.n.1.m.

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\eula-zh-CN.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-16, little-endian text, with very long lines (873), with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):27048
                                                                                                                                                              Entropy (8bit):6.793432528544515
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:dGlhiqpYn3S6kZ5pZsM1SDo9P0VSpjzjW+EpgLDR5CCaGdYjH:dWDuIVZsM19DjzjW+EpgLN5qvjH
                                                                                                                                                              MD5:34638A0DF254C1DAFFE73C8BECE39FB7
                                                                                                                                                              SHA1:7FFB96DFA5937405D4630D4581112F33FD19D637
                                                                                                                                                              SHA-256:CD58B902CFA388E8DF4A4655199ADD588B0754D72019C8E2C796AC560E24DDBB
                                                                                                                                                              SHA-512:5CDB08A626A63F17D5FB45A8F0B5A08536C7E4DAC17F23969D180E07BA49265CD83DD610B64D5795979F127D824E00FF1355F05F949609BE054D230783B8B4A2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..I.n.t.e.l. .S.e.c.u.r.i.t.y. ....SOS...........a"..`.O(u1u .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n. ..vhQD.P[lQ.S .M.c.A.f.e.e. ..c.O.v .I.n.t.e.l. .S.e.c.u.r.i.t.y. .o..N.T.g.R... o..N. ...0 ../f.`.N.b.NKN...v.l._OS.....[..b....b.N.v. o..N. ..sSh.:y.`.T.a..Nag>k...Vdk...N.~.....0 .........,g .I.n.t.e.l. .S.e.c.u.r.i.t.y. ....SOS..... OS... ...m.v.`.O(u. o..N. .vCg)R.0.O(uP.6R.0.b.N.R.~..v^1\. o..N. .v.N9.Hr,g.b.R...T.`6e9..vCg)R...N.S.`.T.a....N...Q.b.NKN...S...N.u.v.NUO.N...0 .,gOS...S+T.b.N.v...y.X.fI{D..Rag>k.v...c .(.h.t.t.p.s.:././.w.w.w...m.c.a.f.e.e...c.o.m./.c.o.m.m.o.n./.p.r.i.v.a.c.y./.c.h.i.n.e.s.e.-.s.i.m.p.l.i.f.i.e.d./.i.n.d.e.x...h.t.m.).....Nag>k._.....v^qQ.T.g.b..(u.N.`.v,g.l._OS...0 ..V.[/.0W:Syr.[.vag>kMO.NOS...v.g.T.Nag.0 ..........Y.g.`*g.n .1.8. ..\...l.g.`.v6r.k.b.v.b.N...N.N._{.HQ.c.S,gOS..v^.Nh..`.{.t. o..N. ...v.T.a...`.N._.O(u. o..N. .b.T.b.N.c.O.`.v*N.N.Oo`.0 .........1......c.S,gOS...T.O9e .. .US.Q. .c.S. .c...b.[.. o..N. ..sSh.:y.`.eag.N.T.a.S,g

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\eula-zh-TW.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-16, little-endian text, with very long lines (904), with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):27300
                                                                                                                                                              Entropy (8bit):6.8524545823843335
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:RLcNdFNy9pQbexWBTeP5s8FmxoFfEgQSPsxFHMOKQZgTmLL/ytmq/5:Rcf6w3BKx/hagQSPsxtKjTmk
                                                                                                                                                              MD5:07D5779D9C37D8E9B2756CA28E4BEC71
                                                                                                                                                              SHA1:82F05279C3CE5A090EDB6D6BD71E2BDD8D406DC7
                                                                                                                                                              SHA-256:72962C3D22F40A9BCC9D41FAA06F4B992311B79349A115FEE4F0E25277C7019B
                                                                                                                                                              SHA-512:4AA0D22B99365E7640FC72CB6870E2FED0557A842160D9B7BCE360C71FF6A64CB790D63CAFF029003F96BE37566BA8AB96203EBD64B03F5FBAB903C5187155BA
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..I.n.t.e.l. .S.e.c.u.r.i.t.y. ..c.k.T.}.........a...`.O(u1u .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n. .hs.P[lQ.S .M.c.A.f.e.e. ..c.O.v .I.n.t.e.l. .S.e.c.u.r.i.t.y. ......g.R...0...0...0 .../f.`...b.PKN...v.l._.T.} .. ..[..bX[.S.b.P.v.0...0..sSh.:y.`.T.a...N.h>k...Vdk..N0}.....0 .........,g .I.n.t.e.l. .S.e.c.u.r.i.t.y. ..c.k.T.}...0.T.}.0...m..`.O(u.0...0.v.k)R.0.O(uP.6R.0.b.P..R.~..&N1\.0...0.v.N..Hr,g.b.R...T.`6e...v.k)R...N.S.`.T.a..N..N...zl.b.PKN...S.."u.u.v.NUO-rp..0 ..b.P.].S.b.b.P.v...y.kr..fI{D..R.h>k.v#.P} .(.h.t.t.p.s.:././.w.w.w...m.c.a.f.e.e...c.o.m./.c.o.m.m.o.n./.p.r.i.v.a.c.y./.c.h.i.n.e.s.e.-.t.r.a.d.i.t.i.o.n.a.l./.i.n.d.e.x...h.t.m.)......N.h>k._.....&NqQ.T.i.bi.(u.e.`.v,g.l._.T.}.0 ..W.[/.0W@Syr.[.v.h>kMO.e.T.}.v.g._.N.h.0 ..........Y.g.`*g.n .1.8. .rk...l.g.`.v6r.k.b.vw..N...N.P._..HQ.c.S,g.T.}&N.Nh..`.{.t.0...0...v.T.a...`.N..AQ1..O(u.0...0.b.T.b.P.c.O.`.v.P.N....0 .........1......c.S,g.T.}.T.O9e .. ..c.N.0.c.S.0.c...b.[..0...0..sSh.:y.`!q.h

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-cs-CZ.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2553
                                                                                                                                                              Entropy (8bit):5.578876173889464
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:3HNBDTz+QdnA/jlE7Nijs371IguQgUlKKGgDlpfkPlC0RbglexOX0wJUGl3nuEIr:3th+y0+7Nks3pIg3lKelpfUlC0lglOOg
                                                                                                                                                              MD5:5AB0AB1F60846B34D5A51CE269BFE191
                                                                                                                                                              SHA1:E75267C19DF7559C464B1AB4BF48AC11CCE7D0D0
                                                                                                                                                              SHA-256:B54F3EBD0121B286DB4EE0A0F732AD3BCB5799FCC02C87BE4D2B24577D7BB47A
                                                                                                                                                              SHA-512:942FF153B55BC8E848AAE5B77F5AF9A4F35CEC5B6505DB4A041671CD1C0D6A3B5E8752521B96F41CFB83A3A628112B39114FD9044BB407F523399896235F3298
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.var _lrInstall_ = {.. EULA_TITLE: "Licen.n. smlouva",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "P.e.etl(a) jsem si licen.n. smlouvu a souhlas.m s n..",.. //{0} - Company name.. THANK_YOU: "D.kujeme, .e jste si vybrali aplikaci {0}.",.. INSTALL: "Nainstalovat",.. CANCEL: "Zru.it",.. RETRY: "Zkusit znovu",.. //{0} - Product name.. PROGRESS_TITLE: "Aplikace {0} poskytuje rady ohledn. va.. bezpe.nosti kdekoli na internetu.",.. PROGRESS_SUBTITLE: "Prob.h. instalace...",.. COMPLETE_TITLE: "V.born.! Aplikace byla nainstalov.na a bude v.m poskytovat rady ohledn. bezpe.nosti na internetu.",.. COMPLETE_SUBTITLE: "V.e je p.ipraveno.",.. COMPLETE_LAUNCH: "Otev..t prohl..e.",.. ERROR_OS_REQUIREMENTS: "V instalaci nelze pokra.ovat, proto.e opera.n. syst.m nespl.uje minim.ln. po.adavky na syst.m. Aktualizujte ho a zkuste to znovu.",.. ERROR_BROWSER_REQUIREMENTS: "V instalaci nelze pokra.ovat, proto.e prohl..

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-da-DK.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2347
                                                                                                                                                              Entropy (8bit):5.3431414467562135
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:37b55gOog4oPO9iEY+0f0t9IcvuZ1Mv9gfdmBnoaljshJdoJ+vOZZOsOhRss1oz6:37jG4f0vI6y1K9gf4lszQ/sfKzMVsLQh
                                                                                                                                                              MD5:C8863CEEF015A3E6DAA696838D0B0944
                                                                                                                                                              SHA1:B3E16B40328FE41CB2AAB0E707B62CA01DD83BA2
                                                                                                                                                              SHA-256:0EF36C832388AE3645EDF50AB0688B3315FA87B3357955215FC53382FEBB5B16
                                                                                                                                                              SHA-512:4E2B196F2BE3DA670612827C12A10FE9011177C5A04D153D48B811AD3395D8F65C115809F69E0E97D5133E2C9D9C90424D290F099C7B4790D7EAF00621683EE4
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.var _lrInstall_ = {.. EULA_TITLE: "Licensaftale",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Jeg har l.st og er indforst.et med licensaftalen",.. //{0} - Company name.. THANK_YOU: "Tak, fordi du valgte {0}",.. INSTALL: "Installer",.. CANCEL: "Annuller",.. RETRY: "Pr.v igen",.. //{0} - Product name.. PROGRESS_TITLE: "{0} er din personlige sikkerhedsr.dgiver, uanset hvor du f.rdes p. nettet.",.. PROGRESS_SUBTITLE: "Installerer ...",.. COMPLETE_TITLE: "Fint. Vi har installeret din personlige onliner.dgiver.",.. COMPLETE_SUBTITLE: "Klar til start",.. COMPLETE_LAUNCH: ".bn browseren",.. ERROR_OS_REQUIREMENTS: "Installationen kan ikke forts.tte, da operativsystemet ikke lever op til minimumssystemkravene. Opdater, og pr.v igen.",.. ERROR_BROWSER_REQUIREMENTS: "Installationen kan ikke forts.tte, da browseren ikke lever op til minimumssystemkravene. Opdater browseren, og pr.v igen.",.. ERROR_VERSION: "Der er allerede installeret e

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-de-DE.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2600
                                                                                                                                                              Entropy (8bit):5.247798933391017
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:3BYBnLb7UozPrEqx8LL+79IAbBblfBWE6ToivxPEbgHIhygeCovzxkI+o5EREQ+W:3BwbkLv+5Ik5lfgq8xAgj/Jvzyi2mi
                                                                                                                                                              MD5:CDE81E5A5525131B07C810F2E9570E8B
                                                                                                                                                              SHA1:85141296BE58EEABF191B292FEFBF736911F488B
                                                                                                                                                              SHA-256:A2D568691E8574BC46746AE27C932475086EDB953558DA39B8ECABCCBBDDA276
                                                                                                                                                              SHA-512:3A003CB7F03A653A7D56A9B2BB3907ABD27903C98941000140428018489A90316E79ED29C8CC4CB9B745959A839614F250DDF405EFE228C183183F18D5261313
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.var _lrInstall_ = {.. EULA_TITLE: "Lizenzvertrag",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Ich habe den Lizenzvertrag gelesen und stimme ihm zu",.. //{0} - Company name.. THANK_YOU: "Vielen Dank f.r Ihren Download von {0}",.. INSTALL: "Installieren",.. CANCEL: "Abbrechen",.. RETRY: "Erneut versuchen",.. //{0} - Product name.. PROGRESS_TITLE: "{0} ist Ihr pers.nlicher Sicherheitsberater f.r das Internet.",.. PROGRESS_SUBTITLE: "Installation l.uft...",.. COMPLETE_TITLE: "Sehr gut. Ihr pers.nlicher Online-Berater wurde installiert.",.. COMPLETE_SUBTITLE: "Fertig",.. COMPLETE_LAUNCH: "Browser .ffnen",.. ERROR_OS_REQUIREMENTS: "Ihre Installation kann nicht fortgesetzt werden, da Ihr Betriebssystem nicht den Mindestsystemanforderungen entspricht. Aktualisieren Sie es, und versuchen Sie es erneut.",.. ERROR_BROWSER_REQUIREMENTS: "Ihre Installation kann nicht fortgesetzt werden, da Ihr Browser nicht den Mindestsystemanforderungen entspr

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-el-GR.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):3909
                                                                                                                                                              Entropy (8bit):4.9560163598227485
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:3x8Ii5SdfTMcIa1KgRfSVl7C8mrs/0wzEjMBGrmQV9N:3V3dfTMcv1Kg5Wluc0wzMy2mM
                                                                                                                                                              MD5:DF92B45C2A9031DB082814879CF64AB8
                                                                                                                                                              SHA1:334BE5ACB918DBC90F56BBAB3BFECBFD17024651
                                                                                                                                                              SHA-256:D29BEA5C380B7FB18E7D1D5B699AA259099D0773DAD34377DD2ABFC0D9D1919D
                                                                                                                                                              SHA-512:C93088341DEB2B55F30A007BAD69743F8C9758F0BE4A63BD1A0756ED2B4D558AD0C9E0DBC0D4540FBBC19F5B3A61833F0664BFF43CF51C6B8F68283A82FB2FB2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.var _lrInstall_ = {.. EULA_TITLE: "........ ...... ......",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "....... ... .......... .. ........ ...... ......",.. //{0} - Company name.. THANK_YOU: "............ ... ......... .. {0}",.. INSTALL: "...........",.. CANCEL: ".......",.. RETRY: ".........",.. //{0} - Product name.. PROGRESS_TITLE: ".. {0} ..... . .......... ... ......... ......... ... ........... ......... ............ ... Internet.",.. PROGRESS_SUBTITLE: "..............",.. COMPLETE_TITLE: "......! ............. ... ......... ... ........ ... Internet.",.. COMPLETE_SUBTITLE: "..... .......",.. COMPLETE_LAUNCH: "....... ............ ..........",.. ERROR

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-en-US.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2294
                                                                                                                                                              Entropy (8bit):5.280870736626376
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:3TmE5KPHEAvhhIDX6uSBf15aN+conkQt5SfEZhozWZIMJJZh4aM:33pAphIzqfE+c63ZhozqxJZh+
                                                                                                                                                              MD5:1C3D02BB8A4CB875D8E7365FBFE99B15
                                                                                                                                                              SHA1:5DA64510DF1C16A9707A702A1E653097EC34B83A
                                                                                                                                                              SHA-256:7E126683B70919563F5BD88306B1C2CBC2F84535B8E929E31955E88FBCB559B5
                                                                                                                                                              SHA-512:7D621A2A014F0C9A9207046CFC5311604EF98C5BE814DEED940BCE1FC705106F0F169A991ABCCDBCBB5D2B01D5DD24ED037EA4A84A514B82CF3F2CB7630BEBEA
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.var _lrInstall_ = {.. EULA_TITLE: "License Agreement",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "I have read and agree to the License Agreement",.. //{0} - Company name.. THANK_YOU: "Thank you for choosing {0}",.. INSTALL: "Install",.. CANCEL: "Cancel",.. RETRY: "Try Again",.. //{0} - Product name.. PROGRESS_TITLE: "{0} is your personal safety advisor wherever you go online.",.. PROGRESS_SUBTITLE: "Installing...",.. COMPLETE_TITLE: "Great! We've installed your personal online advisor.",.. COMPLETE_SUBTITLE: "Ready to go",.. COMPLETE_LAUNCH: "Open my browser",.. ERROR_OS_REQUIREMENTS: "Your installation cannot continue because your operating system does not meet the minimum system requirements. Please update it and try again.",.. ERROR_BROWSER_REQUIREMENTS: "Your installation cannot continue because your browser does not meet our minimum system requirements. Please update your browser and try again.",.. ERROR_VERSION: "You already hav

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-es-ES.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2408
                                                                                                                                                              Entropy (8bit):5.235247483816052
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:3Cx17WnI7bV3mE7NISJvjOfQ2e5loiPLtjCE6zs/vmzuIoJoPl3OmD:3CxB1F337NISUfa5loiRv6AnmzuLJoPr
                                                                                                                                                              MD5:A3DA52AA04E3211D5FC0AA57D8F464ED
                                                                                                                                                              SHA1:B82737DAC0EBE914668D1EC5C912CD1C75AB3A44
                                                                                                                                                              SHA-256:18E1CC9468231683E28A939A46B9EF642613E06CF4DD972ECDC9B0174FE6A16C
                                                                                                                                                              SHA-512:3739069B538C61521A3744376FFADE4D1C42A9D591CAA942F2CA30185887B06B77364812A27679CB34A77CE1832DAF171199CC6C14253E7EA10C93A310C60D79
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.var _lrInstall_ = {.. EULA_TITLE: "Acuerdo de licencia",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "He le.do y acepto el Acuerdo de licencia",.. //{0} - Company name.. THANK_YOU: "Gracias por haber elegido {0}",.. INSTALL: "Instalar",.. CANCEL: "Cancelar",.. RETRY: "Vuelva a intentarlo",.. //{0} - Product name.. PROGRESS_TITLE: "{0} es su asesor de seguridad personal para la navegaci.n online.",.. PROGRESS_SUBTITLE: "Instalando...",.. COMPLETE_TITLE: ".Genial! Hemos instalado su asesor online personal.",.. COMPLETE_SUBTITLE: "Listo para empezar",.. COMPLETE_LAUNCH: "Abrir mi navegador",.. ERROR_OS_REQUIREMENTS: "La instalaci.n no puede continuar porque el sistema operativo no cumple los requisitos m.nimos necesarios del sistema. Actual.celo y vuelva a intentarlo.",.. ERROR_BROWSER_REQUIREMENTS: "La instalaci.n no puede continuar porque el navegador no cumple los requisitos m.nimos necesarios del sistema. Actualice el navegador y

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-es-MX.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2426
                                                                                                                                                              Entropy (8bit):5.242003443957303
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:3Cx17JnI7bVAEc+JJNISJvjOfQ2e5loiPLtjCE6aH/vmzuIoJoPl3O5U+W:3CxBOFNc2JNISUfa5loiRv6aHnmzuLJw
                                                                                                                                                              MD5:1A3778B6298DD1921F1473B3D565C6C0
                                                                                                                                                              SHA1:14517BCED0F8353A613D3872B548D880134A337C
                                                                                                                                                              SHA-256:E3B8A292953DEFE496C47879F354428388FA746481CCEC0D6B07165BE5044AC0
                                                                                                                                                              SHA-512:F3278ED91892328CFC431673D624DE35EF23769F832A66706D6F2D61218F2C6F90A9180DBDF915E6E8A4F0DF1546F554285590754A4BD97C433DCF636CB25EFC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.var _lrInstall_ = {.. EULA_TITLE: "Acuerdo de licencia",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "He le.do y acepto el Acuerdo de licencia",.. //{0} - Company name.. THANK_YOU: "Gracias por elegir {0}",.. INSTALL: "Instalar",.. CANCEL: "Cancelar",.. RETRY: "Vuelva a intentarlo",.. //{0} - Product name.. PROGRESS_TITLE: "{0} es su asesor de seguridad personal para la navegaci.n en l.nea.",.. PROGRESS_SUBTITLE: "Instalando.",.. COMPLETE_TITLE: ".Excelente! Hemos instalado su asesor de seguridad personal en l.nea.",.. COMPLETE_SUBTITLE: "Listo para empezar",.. COMPLETE_LAUNCH: "Abrir mi navegador",.. ERROR_OS_REQUIREMENTS: "La instalaci.n no puede continuar porque el sistema operativo no cumple los requisitos m.nimos necesarios del sistema. Actual.celo y vuelva a intentarlo.",.. ERROR_BROWSER_REQUIREMENTS: "La instalaci.n no puede continuar porque el navegador no cumple los requisitos m.nimos necesarios del sistema. Actualice

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-fi-FI.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2464
                                                                                                                                                              Entropy (8bit):5.327002702111342
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:346H/PfLPVPEajg9IYxDT8i2LKxp8iElfSAnTi7D3/btDM57L6Tsq3sGozCAJIvz:3txsGUIYxHvxZIfLnT03DC5vlqc1zC6U
                                                                                                                                                              MD5:BEEB6B50E9022575A6EE5805B46AB946
                                                                                                                                                              SHA1:C625DED4FC20A38F9A9C722979FDB672F77BC8E4
                                                                                                                                                              SHA-256:36D3398539B02C7F2AB58D6E2F4B8377090AC074D2D6B23CCC6735963D47EC6C
                                                                                                                                                              SHA-512:604F3F5A48C375C1CC03F6DFF204E9602C406C5EE3F57585A59DA151660EA8453F1E1EA2C26A870D6770A26DEA4BE51DBAFF81827C62C33D8FF595B6D500AB7D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.var _lrInstall_ = {.. EULA_TITLE: "K.ytt.oikeussopimus",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Olen lukenut k.ytt.oikeussopimuksen ja hyv.ksyn sen.",.. //{0} - Company name.. THANK_YOU: "Kiitos, ett. valintasi on {0}",.. INSTALL: "Asenna",.. CANCEL: "Peruuta",.. RETRY: "Yrit. uudelleen",.. //{0} - Product name.. PROGRESS_TITLE: "{0} on henkil.kohtainen turvallisuusavustajasi, kun k.yt.t verkkoa.",.. PROGRESS_SUBTITLE: "Asennetaan.",.. COMPLETE_TITLE: "Hienoa! Henkil.kohtainen verkkoavustajasi on asennettu.",.. COMPLETE_SUBTITLE: "Valmis k.ytett.v.ksi",.. COMPLETE_LAUNCH: "K.ynnist. selain",.. ERROR_OS_REQUIREMENTS: "Asennusta ei voi jatkaa, koska k.ytt.j.rjestelm.si ei t.yt. j.rjestelm.n v.himm.isvaatimuksia. P.ivit. k.ytt.j.rjestelm. ja yrit. uudelleen.",.. ERROR_BROWSER_REQUIREMENTS: "Asennusta ei voi jatkaa, koska selaimesi ei t.yt. j.rjestelm.n v.himm.isvaatimuksia. P.ivit. selain ja yr

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-fr-CA.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2783
                                                                                                                                                              Entropy (8bit):5.261579856897994
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:3XYTQm7+XFcEqEmfX8IEKOIgkPgPjynfHzz8zq5n3k+HGjKm9bQErQz4YxkLzEtt:3XFVZxmfX8IX/gwfHz4zotKtrgxwzUhN
                                                                                                                                                              MD5:A8D94EE05B19DA3B8987B096C1EBD81F
                                                                                                                                                              SHA1:1A081240B7FEA5F425D1214146285228EDFC7BE7
                                                                                                                                                              SHA-256:D0C5C3B16AABFD43C82BD8E59CC2421B9160C5C0ECF1332A2AF468801003F962
                                                                                                                                                              SHA-512:3C3F6ABDD715C7046CC47C98A2DFA334BB1A8E91CC832937A2D9E30A9C0B1330D24DE920949739F32DC2EB27D097918830B670AAFDF03AECF93C2C87F2847F64
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.var _lrInstall_ = {.. EULA_TITLE: "Contrat de licence",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "J'ai lu et approuv. le contrat de licence",.. //{0} - Company name.. THANK_YOU: "Merci d'avoir choisi {0}",.. INSTALL: "Installation",.. CANCEL: "Annuler",.. RETRY: "R.essayez",.. //{0} - Product name.. PROGRESS_TITLE: "{0} est votre conseiller personnel en mati.re de s.curit. lorsque vous naviguez en ligne.",.. PROGRESS_SUBTITLE: "Installation...",.. COMPLETE_TITLE: "Tr.s bien! Nous avons install. votre conseiller personnel en mati.re de s.curit. en ligne.",.. COMPLETE_SUBTITLE: "Pr.t au lancement",.. COMPLETE_LAUNCH: "Ouvrir mon navigateur",.. ERROR_OS_REQUIREMENTS: "Il est impossible de poursuivre l'installation, car votre syst.me d'exploitation ne satisfait pas . la configuration minimale requise. Veuillez le mettre . jour et essayer de nouveau.",.. ERROR_BROWSER_REQUIREMENTS: "Il est impossible de poursuivre l'installatio

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-fr-FR.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2672
                                                                                                                                                              Entropy (8bit):5.282188728440805
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:3skZTOo+8CFRhEq5wkQ8I5yb7npX3uyb6FpYE3Kfjvz75B8g5DVdNABqbkyETa4u:3skOdRqM/Q8I5W7duW64sKfjvz1mmzX/
                                                                                                                                                              MD5:4598750960951475D558A6565788F53A
                                                                                                                                                              SHA1:94B9171A41ED0B293FFB0CBE1A64535AB1F35DB0
                                                                                                                                                              SHA-256:CC3F38CCC15D7729E693B407E61A903B7FFE7C8FBE95ADBA1ED4E474D2480916
                                                                                                                                                              SHA-512:15ECD80BABF2B0C76E284B1B75DFFA9EC4B169E74641C777F96740296399DA3CDA32875912A5E3509F11266044332F65A9F077AC13211A1513DD972559E5CD21
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.var _lrInstall_ = {.. EULA_TITLE: "Accord de licence",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "J'ai lu et j'accepte l'accord de licence",.. //{0} - Company name.. THANK_YOU: "Merci d'avoir choisi {0}",.. INSTALL: "Installer",.. CANCEL: "Annuler",.. RETRY: "R.essayer",.. //{0} - Product name.. PROGRESS_TITLE: "{0} est votre conseiller personnel en mati.re de s.curit. o. que vous vous trouviez en ligne.",.. PROGRESS_SUBTITLE: "Installation...",.. COMPLETE_TITLE: "Tr.s bien. Nous avons install. votre conseiller en ligne personnel.",.. COMPLETE_SUBTITLE: "Pr.t",.. COMPLETE_LAUNCH: "Ouvrir mon navigateur",.. ERROR_OS_REQUIREMENTS: "Votre installation ne peut pas se poursuivre car votre syst.me d'exploitation ne correspond pas . la configuration syst.me minimale requise. Mettez-le . jour et essayez . nouveau.",.. ERROR_BROWSER_REQUIREMENTS: "Votre installation ne peut pas se poursuivre car votre navigateur ne correspond pas .

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-hr-HR.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2472
                                                                                                                                                              Entropy (8bit):5.341339631479869
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:353pQsd9EjihC7lRIZYwfChm7gg7oG9RMGbm6O6IgXvzU6MIIJC52jdejH05N:3bdYjQgrIBfvMg7JruJgfzU6MIGC52xn
                                                                                                                                                              MD5:2ADABC7FBDAC3051AACB2830E2C471D5
                                                                                                                                                              SHA1:F588275E6866898A80A501EB8605584875B5952E
                                                                                                                                                              SHA-256:6B8B6978D48E30FFC5FDC635F0868B84ADF731F1E99FA161A8CCD3047C1B35C1
                                                                                                                                                              SHA-512:1B942C2A4C7AB16F4A66F88EFFC4F44731E1771333661FDA24C8540E4931AF2F1D1379553CA183B48E38273FAE3209CD703C6923280E388FE44A05A8ACB8D67A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.var _lrInstall_ = {.. EULA_TITLE: "Licencni ugovor",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Pro.itao/la sam i prihva.am Licencni ugovor",.. //{0} - Company name.. THANK_YOU: "Zahvaljujemo .to ste odabrali tvrtku {0}",.. INSTALL: "Instaliraj",.. CANCEL: "Odustani",.. RETRY: "Poku.ajte ponovno",.. //{0} - Product name.. PROGRESS_TITLE: "{0} va. je osobni savjetnik o sigurnosti neovisno o tome gdje se nalazite na mre.i.",.. PROGRESS_SUBTITLE: "Instaliranje...",.. COMPLETE_TITLE: "Sjajno! Instalirali smo va.eg osobnog savjetnika na mre.i.",.. COMPLETE_SUBTITLE: "Spremno za rad",.. COMPLETE_LAUNCH: "Otvori moj preglednik",.. ERROR_OS_REQUIREMENTS: "Instalaciju nije mogu.e nastaviti jer va. operacijski sustav ne ispunjava minimalne preduvjete sustava. A.urirajte ga i poku.ajte ponovno.",.. ERROR_BROWSER_REQUIREMENTS: "Instalaciju nije mogu.e nastaviti jer va. preglednik ne ispunjava minimalne preduvjete sustava. A.urirajte p

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-hu-HU.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2712
                                                                                                                                                              Entropy (8bit):5.517131305008962
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:3tLzMpIEAIQIsOGfHgoZciWDBMK+Q4L8NPpTWzn9jIaLe7aW:3dy1AIQIafrCiMBMK48NPpazndBe7aW
                                                                                                                                                              MD5:2C49A43F784B46E3523F1A297E09AC4B
                                                                                                                                                              SHA1:6AFE3B0A3D981FF6A7B7BAD93DFADB235AE0940A
                                                                                                                                                              SHA-256:9016318A9AE4B21D4F3EBBB0068C7AA9EBC0216F151180879A57495ECFF2E399
                                                                                                                                                              SHA-512:DC35BC2FA4A2CC8E3AAB7ABBC9CCC206B4989D2BD1E0C1EC1F9AAAD56C02814EA77634956FF52FCBAEBFCD8E810A31C9D386642A82EC90B2D3B34E972C6DCEC1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.var _lrInstall_ = {.. EULA_TITLE: "Licencmeg.llapod.s",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Elolvastam .s elfogadom a Licencmeg.llapod.st",.. //{0} - Company name.. THANK_YOU: "K.sz.nj.k, hogy a(z) {0} mellett d.nt.tt",.. INSTALL: "Telep.t.s",.. CANCEL: "M.gse",.. RETRY: "Pr.b.lkozzon .jra",.. //{0} - Product name.. PROGRESS_TITLE: "{0} az .n szem.lyi tan.csad.ja, aki mindenhova .nnel tart az interneten.",.. PROGRESS_SUBTITLE: "Telep.t.s...",.. COMPLETE_TITLE: "Rendben. Szem.lyi tan.csad.j.nak telep.t.se sikeresen befejez.d.tt.",.. COMPLETE_SUBTITLE: "Haszn.latra k.sz",.. COMPLETE_LAUNCH: "B.ng.sz. megnyit.sa",.. ERROR_OS_REQUIREMENTS: "A telep.t.s nem folytat.dhat, mivel az oper.ci.s rendszer nem felel meg a minim.lis rendszerk.vetelm.nyeknek. Hajtsa v.gre a friss.t.st, majd pr.b.lkozzon .jra.",.. ERROR_BROWSER_REQUIREMENTS: "A telep.t.s nem folytat.dhat, mivel a b.ng.sz. n

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-it-IT.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2394
                                                                                                                                                              Entropy (8bit):5.271867935881046
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:3UWhiWDdQoGoIt/EqRw0+KIbpxLWpuKf/XG+E6lGN5/5wZplY8547w6ZzE+IR1u1:3dqrt820KInL9KfO+Evf5y0jZzNG1u0I
                                                                                                                                                              MD5:BF9134324703723EE6C2691CE9D8DBC9
                                                                                                                                                              SHA1:C0B3BFA4FAB6A4DEFEB096CC1A07C4F82F99F9BD
                                                                                                                                                              SHA-256:55E409844A47BA5263E399E66D1C883A458DCC71B3857D71DEB8DECA0FF056DF
                                                                                                                                                              SHA-512:617DF53D7284424A2E459E0ED2E1A43A98B344568586E7E5EC346DC8AC0C27C4F10004E4567E03FCE042194EED77A8D92132053F08EBC557CAD2872ED87C34DC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.var _lrInstall_ = {.. EULA_TITLE: "Contratto di licenza",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Ho letto e accetto il contratto di licenza",.. //{0} - Company name.. THANK_YOU: "Grazie per aver scelto {0}",.. INSTALL: "Installa",.. CANCEL: "Annulla",.. RETRY: "Riprova",.. //{0} - Product name.. PROGRESS_TITLE: "{0} . il tuo consulente sulla sicurezza personale quando sei online.",.. PROGRESS_SUBTITLE: "Installazione in corso...",.. COMPLETE_TITLE: "Perfetto! Abbiamo installato il tuo consulente sulla sicurezza online personale.",.. COMPLETE_SUBTITLE: "Pronto all'uso",.. COMPLETE_LAUNCH: "Apri browser",.. ERROR_OS_REQUIREMENTS: "L'installazione non pu. proseguire poich. il sistema operativo non soddisfa i requisiti minimi di sistema. Aggiornalo e riprova.",.. ERROR_BROWSER_REQUIREMENTS: "L'installazione non pu. proseguire poich. il browser non soddisfa i requisiti minimi di sistema. Aggiorna il browser e riprova.",.. ERROR_VE

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-ja-JP.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):3042
                                                                                                                                                              Entropy (8bit):5.654730225449592
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:3wGDxx6nDARECJhlFV0Inu4+nc4sf79U6MwMiWBmxjGlmDr2hvuskl2KzYzKIKvf:3wwT6c62zFV0InOnKf726pEm2mqvSZzf
                                                                                                                                                              MD5:DAB83F56632484FED3A1CF450110EB37
                                                                                                                                                              SHA1:DED6A149E0001D8995DD59168C42DF971E22014E
                                                                                                                                                              SHA-256:942EDAE46D4D05618C2C46CB9EFE5498E41D576358C0D4F179E53A797CE8E7F8
                                                                                                                                                              SHA-512:B9A29EE0A58A273661F19001F60238AC276D079E94C76BBD6128C86C0D0CE377334FD6C213D524BDDF925B68C727B583560E18A575C8216157495E5CE6811A25
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.var _lrInstall_ = {.. EULA_TITLE: "......",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "......................",.. //{0} - Company name.. THANK_YOU: "{0} ...................",.. INSTALL: "......",.. CANCEL: ".....",.. RETRY: "...",.. //{0} - Product name.. PROGRESS_TITLE: "{0} ...................................",.. PROGRESS_SUBTITLE: "..............",.. COMPLETE_TITLE: "....... ........... ...................",.. COMPLETE_SUBTITLE: "........",.. COMPLETE_LAUNCH: "........",.. ERROR_OS_REQUIREMENTS: "....................... ....................

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-ko-KR.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2602
                                                                                                                                                              Entropy (8bit):5.823682248878467
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:3SvoaWNG4EaECInqhq5fqYb26FugHU98U5MmilHU5n9HU5MKzpNKI6iUIX2z0Rjk:3S84Fa9Inqhq5fLjFF0WU5Mmi5U5nRUo
                                                                                                                                                              MD5:AFEEFF224380D86DEC81D1D12A074ABE
                                                                                                                                                              SHA1:67EBA5B26987677B4054A2A0F2ED6FC1B2A9160A
                                                                                                                                                              SHA-256:24387D43CD56EEB191446337BE127BC3ECC2458CA632D0C31F9D00F204FA7C25
                                                                                                                                                              SHA-512:B18B3A315840B7C77427C9038099F3DD76FF2F4678E3569CF609D873019E3A31B59FA180E73B3CA1C2991D8F96CE7A67D4B9BBB7A9EDF9A2C9F6ADC0F6459A49
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.var _lrInstall_ = {.. EULA_TITLE: "... ..",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "... ... .. .. ......",.. //{0} - Company name.. THANK_YOU: "{0} ... ... ... ......",.. INSTALL: "..",.. CANCEL: "..",.. RETRY: ".. ..",.. //{0} - Product name.. PROGRESS_TITLE: "{0}. .. .... .. .. .. ... .......",.. PROGRESS_SUBTITLE: ".. ....",.. COMPLETE_TITLE: "....! .. ... .... .......",.. COMPLETE_SUBTITLE: "... ... .....",.. COMPLETE_LAUNCH: ". .... ..",.. ERROR_OS_REQUIREMENTS: "..... .. ... ... .... .... ... ... . ..... ..... ...... .. .......",.. ERROR_BROWSER_REQUIREMENTS: "..... .. ... ... .... ...

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-nb-NO.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2387
                                                                                                                                                              Entropy (8bit):5.318938208830283
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:3795VOotrOcpVDEY4IRw0/9IcBVFDqFafj8Kae0QJhGd/i+GFPxWj0ssjzr9cIUD:37R7pVgzCw0VIaVFuFaf3l5QAfjzrKZD
                                                                                                                                                              MD5:C839A3727584F4C9E04852B4C1B11504
                                                                                                                                                              SHA1:0D0882C7C38ACBDE41BEECAD5AC583CCA15AEC10
                                                                                                                                                              SHA-256:A6D848BAB103D69D356C370BD9C07451956A4F47427243821585720E4B39302B
                                                                                                                                                              SHA-512:1DC03A728E459835CAD6671A8A649277600AC341170E0A026D8C57DBDBA5867316E84F94D8B0048B8FDEB19EA0C213D5F1B60044F1458F67DAA0063C9E817E61
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.var _lrInstall_ = {.. EULA_TITLE: "Lisensavtale",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Jeg har lest og godtar lisensavtalen",.. //{0} - Company name.. THANK_YOU: "Takk for at du har valgt {0}",.. INSTALL: "Installer",.. CANCEL: "Avbryt",.. RETRY: "Pr.v p. nytt",.. //{0} - Product name.. PROGRESS_TITLE: "{0} er din personlige sikkerhetsr.dgiver n.r du er p. Internett.",.. PROGRESS_SUBTITLE: "Installerer..",.. COMPLETE_TITLE: "Flott! Vi har installert din personlige Internett-r.dgiver.",.. COMPLETE_SUBTITLE: "Klar til . sette i gang",.. COMPLETE_LAUNCH: ".pne nettleseren min",.. ERROR_OS_REQUIREMENTS: "Installasjonen kan ikke fortsette fordi operativsystemet ikke oppfyller minimum systemkrav. Oppdater det og pr.v p. nytt.",.. ERROR_BROWSER_REQUIREMENTS: "Installasjonen kan ikke fortsette fordi nettleseren ikke oppfyller minimum systemkrav. Oppdater nettleseren og pr.v p. nytt.",.. ERROR_VERSION: "Det ser ut til at d

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-nl-NL.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2494
                                                                                                                                                              Entropy (8bit):5.222116866736417
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:3HZ/GOx7kopP4IeGyEY/n40AcTI3k7JWxXDk7JdIXrf24+0nB7v7lRbY2ID6XVUs:3Hb+nAqjAkI3WcxXDWPIXrfwkBD9i6Xf
                                                                                                                                                              MD5:29CF7E2CD6093B24FD7C37966462A68E
                                                                                                                                                              SHA1:E528B2970AC92753142FB1F286DFF3E65437F3BF
                                                                                                                                                              SHA-256:3F4F01C55C2F6D31C62B5D25601EAC706E7FB6CF410E2126A1DBECE95DD1BCD7
                                                                                                                                                              SHA-512:4F4FB8A3189D562A6B3003D7427620908710A8CAC97818100702B4530D8B02349F62D5B5F7A8A63854606FCFC5F9BB2788F0E8B122D1C5F5584179C9FEEF46EA
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.var _lrInstall_ = {.. EULA_TITLE: "Licentieovereenkomst",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Ik heb de Licentieovereenkomst gelezen en ga ermee akkoord",.. //{0} - Company name.. THANK_YOU: "Hartelijk dank dat u hebt gekozen voor {0}",.. INSTALL: "Installeren",.. CANCEL: "Annuleren",.. RETRY: "Opnieuw proberen",.. //{0} - Product name.. PROGRESS_TITLE: "{0} is uw persoonlijke veiligheidsadviseur waar u ook online gaat.",.. PROGRESS_SUBTITLE: "Installeren...",.. COMPLETE_TITLE: "Fantastisch! We hebben uw persoonlijke online adviseur ge.nstalleerd.",.. COMPLETE_SUBTITLE: "U bent klaar om te beginnen",.. COMPLETE_LAUNCH: "Open mijn browser",.. ERROR_OS_REQUIREMENTS: "Uw installatie kan niet worden voortgezet omdat uw besturingssysteem niet voldoet aan de minimale systeemvereisten. Werk het bij en probeer het opnieuw.",.. ERROR_BROWSER_REQUIREMENTS: "Uw installatie kan niet worden voortgezet omdat uw browser niet voldoet aan onze mi

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-pl-PL.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2589
                                                                                                                                                              Entropy (8bit):5.5402027850437126
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:31Mp2pQa6EiVoNIGz2wizAsferOrW6IjW1FRHZZ8z0h0hXigYDzgzI77cclvNzCg:3r+0iVQI5wJsf8GW6IjqfHZchygYDzgU
                                                                                                                                                              MD5:931BD24E50B0B660EB2C78E688D514CB
                                                                                                                                                              SHA1:E5535394B3F262F9737F407464075D16C49D3DAA
                                                                                                                                                              SHA-256:3636E0F97D0334D7CDEBFB02C96A17B7EBAB637086E386FB1D4DBBB6C938AC15
                                                                                                                                                              SHA-512:2B6743AD3816D1F979DF91330C3988C9BA500F7BBF09EC1C4B9D664B8B04548EE7B6C43B57C6158B768261E97E0C0EA200C6C6AA888FA897F89DC7CD298AA465
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.var _lrInstall_ = {.. EULA_TITLE: "Umowa licencyjna",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Potwierdzam znajomo.. warunk.w umowy licencyjnej i akceptuj. je.",.. //{0} - Company name.. THANK_YOU: "Dzi.kujemy za wybranie firmy {0}",.. INSTALL: "Zainstaluj",.. CANCEL: "Anuluj",.. RETRY: "Spr.buj ponownie",.. //{0} - Product name.. PROGRESS_TITLE: "Program {0} to Tw.j osobisty doradca bezpiecze.stwa online.",.. PROGRESS_SUBTITLE: "Instalowanie...",.. COMPLETE_TITLE: ".wietnie. Tw.j osobisty doradca bezpiecze.stwa online zosta. zainstalowany.",.. COMPLETE_SUBTITLE: "Gotowe",.. COMPLETE_LAUNCH: "Otw.rz przegl.dark.",.. ERROR_OS_REQUIREMENTS: "Nie mo.na kontynuowa. instalacji, poniewa. system operacyjny nie spe.nia minimalnych wymaga. systemowych. Zaktualizuj system i spr.buj ponownie.",.. ERROR_BROWSER_REQUIREMENTS: "Nie mo.na kontynuowa. instalacji, poniewa. przegl.darka nie spe.nia minimalnych wymaga. systemow

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-pt-BR.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2414
                                                                                                                                                              Entropy (8bit):5.300178421230568
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:30pLnIOYwREtajaI1BKraNfZwe6GcIe+LLCEHxg5aozFVI1rJqPe6:3VI68jaIjNf9F3Hwbz3aJqPh
                                                                                                                                                              MD5:D4D84878C7D306CB61F4232DADA10E39
                                                                                                                                                              SHA1:690C20BF37926BB1F9E0AD8DD1612FA71FCA4837
                                                                                                                                                              SHA-256:B58CE3589BE0BC6C882DAA5E18856E5850FA12B766530685FB99FD03F0FFC762
                                                                                                                                                              SHA-512:E8E3033EC8EC3823CE8F0BA1981748199814E7D74D8DE55202DFC3A7224B07246CE6B923AD75F0240650CFB69745D622FD3F44DAA12AD1589EEAA436C85452DF
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.var _lrInstall_ = {.. EULA_TITLE: "Contrato de Licen.a",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Li e concordo com o Contrato de Licen.a",.. //{0} - Company name.. THANK_YOU: "Obrigado por escolher {0}",.. INSTALL: "Instalar",.. CANCEL: "Cancelar",.. RETRY: "Tentar novamente",.. //{0} - Product name.. PROGRESS_TITLE: "{0} . o seu assessor de seguran.a personalizado onde quer que voc. navegue.",.. PROGRESS_SUBTITLE: "Instalando...",.. COMPLETE_TITLE: "Excelente! O seu assessor online personalizado foi instalado.",.. COMPLETE_SUBTITLE: "Pronto para come.ar",.. COMPLETE_LAUNCH: "Abrir meu navegador",.. ERROR_OS_REQUIREMENTS: "A instala..o n.o pode continuar. Seu sistema operacional n.o atende aos requisitos m.nimos do sistema. Atualize-o e tente novamente.",.. ERROR_BROWSER_REQUIREMENTS: "A instala..o n.o pode continuar. Seu navegador n.o atende aos requisitos m.nimos do sistema. Atualize o navegador e tente novamente.",.

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-pt-PT.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2407
                                                                                                                                                              Entropy (8bit):5.2811280024325296
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:30pgnIuAGE6y4IvQdKVvNfwSe6GfIhq+L1w9V5eEHp4aUzFy5JI1rJqPlEzTK8:3uhX6y4IvQdUlfKF3PHHp4DziaJqPlEx
                                                                                                                                                              MD5:F809637BD4E0ABA13533019D39726E36
                                                                                                                                                              SHA1:789D46AF8AFB6B592F2606DF707F0CC350BB6DD2
                                                                                                                                                              SHA-256:1F1FCE2B24E49F973698E1C9F1D11ECD97214AE54E75E06550F6451933583603
                                                                                                                                                              SHA-512:3AAFC06AF04FA83D1022FCBE140FA888581BDCCC76049E8B7DD419F3D279C9C177EE202FFD17351EC0565E2F526BC060405818240D4FC17CE29B28E6E294CCF8
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.var _lrInstall_ = {.. EULA_TITLE: "Contrato de Licen.a",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Li e concordo com o Contrato de Licen.a",.. //{0} - Company name.. THANK_YOU: "Obrigado por escolher a {0}",.. INSTALL: "Instalar",.. CANCEL: "Cancelar",.. RETRY: "Tentar Novamente",.. //{0} - Product name.. PROGRESS_TITLE: "O {0} . o seu assistente de seguran.a pessoal quando navega online.",.. PROGRESS_SUBTITLE: "A instalar...",.. COMPLETE_TITLE: ".timo! Instal.mos o seu assistente pessoal online.",.. COMPLETE_SUBTITLE: "Pronto a utilizar",.. COMPLETE_LAUNCH: "Abrir o meu browser",.. ERROR_OS_REQUIREMENTS: "N.o . poss.vel continuar a instala..o porque o seu sistema operativo n.o cumpre os requisitos m.nimos do sistema. Atualize-o e tente novamente.",.. ERROR_BROWSER_REQUIREMENTS: "N.o . poss.vel continuar a instala..o porque o seu browser n.o cumpre os nossos requisitos m.nimos do sistema. Atualize o seu browser e ten

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-ru-RU.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):3518
                                                                                                                                                              Entropy (8bit):4.985882573875821
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:3UVaCuKa+4I4QashQrsyfb6yJBvr8/zsPoSBRt7m:3UVMKaN91jb6yg/z2oSBRw
                                                                                                                                                              MD5:87FF05890CC4FA0CE9EB12EBBDBFFEF9
                                                                                                                                                              SHA1:D599F01B26318402A73B13FB3A6C23E1ABC45B40
                                                                                                                                                              SHA-256:138C7B5FA7E29D60BCB59803BD1791FC6956F6D3CEE66B4424455A191F4CD76B
                                                                                                                                                              SHA-512:8AA58A0F6C693E1BD917B9EAC76AC06391E8559ED0ECA1FB9B18BE13B19C55B90FB95D1FD67E09A809CF68E79C9A69CFDBC68BEA2F605926745BC29DE9A9750D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.var _lrInstall_ = {.. EULA_TITLE: "............ ..........",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: ".... ......... . ....... ....... ............. ..........",.. //{0} - Company name.. THANK_YOU: ".......... ... .. ..... {0}",.. INSTALL: "..........",.. CANCEL: "......",.. RETRY: "......... .......",.. //{0} - Product name.. PROGRESS_TITLE: "{0} . ... ...... ........ .. ........ ............ . ..........",.. PROGRESS_SUBTITLE: "............",.. COMPLETE_TITLE: ".......! ...... ........ .. ........ ............ ...........",.. COMPLETE_SUBTITLE: "... ......",.. COMPLETE_LAUNCH: "....... .......",.. ERROR_OS_REQUIREMENTS: "......... .......... ..........

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-sk-SK.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2503
                                                                                                                                                              Entropy (8bit):5.600421010907289
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:3KUCaDVRZIB0HHEFYdVXIBJSoAcJSjAKf+EPnAn9kwk8Aw7JmERmPezlU8IPJicD:3K94Bu0HkFoXImoArjAKf+EPnAnewk80
                                                                                                                                                              MD5:A450F69D70B5A4859E5CA90B12CD50E1
                                                                                                                                                              SHA1:7F789044E7408CCF4997EEE30812314A0FBC0E7C
                                                                                                                                                              SHA-256:4BE61DD817F04C8BB186B88D8A1D107913D1D806140BB0706E57C65B2984550A
                                                                                                                                                              SHA-512:113FD4F5C44CA4E99347B23EE1B3D479D605A5A1FF97F847AC209FB3F5F746F58C0BBB1D03E0237D5373A1F4C32E31CDBD4129659A7524FA3080B056C1BDAF51
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.var _lrInstall_ = {.. EULA_TITLE: "Licen.n. zmluva",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Pre..tal(-a) som si licen.n. zmluvu a s.hlas.m s .ou",.. //{0} - Company name.. THANK_YOU: ".akujeme, .e ste si zvolili {0}",.. INSTALL: "In.talova.",.. CANCEL: "Zru.i.",.. RETRY: "Sk.si. znova",.. //{0} - Product name.. PROGRESS_TITLE: "{0} je v.. osobn. bezpe.nostn. poradca pri va.ich potulk.ch internetom.",.. PROGRESS_SUBTITLE: "In.taluje sa...",.. COMPLETE_TITLE: "Skvel.! Osobn. poradca online je nain.talovan..",.. COMPLETE_SUBTITLE: "Hotovo",.. COMPLETE_LAUNCH: "Otvori. prehliada.",.. ERROR_OS_REQUIREMENTS: "V in.tal.cii nie je mo.n. pokra.ova., preto.e opera.n. syst.m nesp..a minim.lne syst.mov. po.iadavky. Aktualizujte ho a sk.ste to znova.",.. ERROR_BROWSER_REQUIREMENTS: "V in.tal.cii nie je mo.n. pokra.ova., preto.e prehliada. nesp..a minim.lne syst.mov. po.iadavky. Aktuali

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-sr-Latn-CS.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2366
                                                                                                                                                              Entropy (8bit):5.3768373030606895
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:3iWxpQUZMEji4CqYBIInphvGEfD/cTdRCcegQ6DRjRSGnzUwMIIJLQ5omqzVi:3ikbTjBrGIAH7fD/cpUdiRcGnzUwMIA4
                                                                                                                                                              MD5:4F5099D80FC9D7605B99B48F3020BC96
                                                                                                                                                              SHA1:3F2B8947F3C4D5D02DD5B120E929EB4F874CD1F0
                                                                                                                                                              SHA-256:B7437A1AD8F6493A56C19FA05EE4F217485A80B1974550DBCE92BDA71073FE7F
                                                                                                                                                              SHA-512:55F86379A59E20FEC38C0D58A19462B67C9B7F4323E9AF14BEC97435A99771130CE80303E525667A3087824776E2F9A6A069ED8BCB13C9C4DC93C616702EC9A6
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.var _lrInstall_ = {.. EULA_TITLE: "Ugovor o licenciranju",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Pro.itao/la sam i saglasan/na sam sa ugovorom o licenciranju",.. //{0} - Company name.. THANK_YOU: "Hvala vam .to ste odabrali {0}",.. INSTALL: "Instaliraj",.. CANCEL: "Otka.i",.. RETRY: "Poku.ajte ponovo",.. //{0} - Product name.. PROGRESS_TITLE: "{0} je va. li.ni savetnik kada god ste na mre.i.",.. PROGRESS_SUBTITLE: "Instaliranje...",.. COMPLETE_TITLE: "Odli.no! Instalirali smo va. li.ni savetnik na mre.i.",.. COMPLETE_SUBTITLE: "Spremno je",.. COMPLETE_LAUNCH: "Otvori pregleda.",.. ERROR_OS_REQUIREMENTS: "Instalacija ne mo.e da se nastavi zato .to sistem ne ispunjava minimalne zahteve. A.urirajte i poku.ajte ponovo.",.. ERROR_BROWSER_REQUIREMENTS: "Instalacija ne mo.e da se nastavi zato .to pregleda. ne ispunjava minimalne zahteve sistema. A.urirajte pregleda. i poku.ajte ponovo.",.. ERROR_VERSION: "Ve. imat

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-sv-SE.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2265
                                                                                                                                                              Entropy (8bit):5.377059836934604
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:3Ud6ODtNYPmAEYSwxFjIcvFLcFafDyMC/4ekY3+rh7sK0MCoO0oz/wrIfGEzjZUi:30DNcnIiFgFaf+imYJOvz4rCR0M
                                                                                                                                                              MD5:495BE39C598896B6B7B0A70535ADE2B4
                                                                                                                                                              SHA1:8122CE1A1B89801B48B9C8DA6DEBD2F786214290
                                                                                                                                                              SHA-256:89DBDA42D8FE01B407075ED31E004955A4081446881E86F2AA40270BD6996BAF
                                                                                                                                                              SHA-512:0CB7FFDEA211EC16EDD5DF8D9E43028F0A35078258093EAF21335224E09F1DEEE17677A895E15DDD06B831B92C1B996CB418DF022CF246E59A386ABD53FF3EF8
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.var _lrInstall_ = {.. EULA_TITLE: "Licensavtal",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Jag har l.st och godk.nner licensavtalet",.. //{0} - Company name.. THANK_YOU: "Tack f.r att du valde {0}",.. INSTALL: "Installera",.. CANCEL: "Avbryt",.. RETRY: "F.rs.k igen",.. //{0} - Product name.. PROGRESS_TITLE: "{0} .r din personliga s.kerhetsr.dgivare online.",.. PROGRESS_SUBTITLE: "Installerar...",.. COMPLETE_TITLE: "Perfekt. Vi har installerat din personliga r.dgivare online.",.. COMPLETE_SUBTITLE: "Klar att anv.nda",.. COMPLETE_LAUNCH: ".ppna min webbl.sare",.. ERROR_OS_REQUIREMENTS: "Installationen avbr.ts eftersom ditt operativsystem inte uppfyller systemkraven. Uppdatera och f.rs.k igen.",.. ERROR_BROWSER_REQUIREMENTS: "Installationen avbr.ts eftersom din webbl.sare inte uppfyller systemkraven. Uppdatera webbl.saren och f.rs.k igen.",.. ERROR_VERSION: "En nyare version av programvaran .r redan installerad p.

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-tr-TR.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2564
                                                                                                                                                              Entropy (8bit):5.494726145853308
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:3DdmZCox80uGgE+dh70Ij+AUJBI+AxuzfvF57ybqEmpwAY3LgMseo44oU+Wz7kjR:3kwoK0v+dhYIjMs5uzf7g5ue5Lgz6CXq
                                                                                                                                                              MD5:09769D162F0EFE8FDAAC4B1F3C1454E4
                                                                                                                                                              SHA1:6526A54787118AB1318E1AA2A8FF81C985FA3DB3
                                                                                                                                                              SHA-256:A9165FD9F71437FC784C71958BFE18D9E24F3D0B1468A7F09F8A8F7FE387A8F2
                                                                                                                                                              SHA-512:54F4DE072649C115DF49ED4F722C3F8D09E0A8570E148433AD20AAB7A88365B697964D1E65673F62933279E299D2E4D9CF5F048319B42F457816CD4A9C84FD0D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.var _lrInstall_ = {.. EULA_TITLE: "Lisans S.zle.mesi",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "Lisans S.zle.mesi'ni okudum ve kabul ediyorum",.. //{0} - Company name.. THANK_YOU: "{0}'yi se.ti.iniz i.in te.ekk.rler",.. INSTALL: "Y.kle",.. CANCEL: ".ptal",.. RETRY: "Yeniden Dene",.. //{0} - Product name.. PROGRESS_TITLE: "{0} Internet'te her an yan.n.zda olan ki.isel g.venlik dan..man.n.zd.r.",.. PROGRESS_SUBTITLE: "Y.kleniyor...",.. COMPLETE_TITLE: "Harika! Ki.isel .evrimi.i dan..man.n.z. y.kledik.",.. COMPLETE_SUBTITLE: "Kullan.ma haz.r",.. COMPLETE_LAUNCH: "Taray.c.m. a.",.. ERROR_OS_REQUIREMENTS: "..letim sisteminiz minimum sistem gereksinimlerini kar..lamad...ndan y.kleme i.lemine devam edilemiyor. L.tfen g.ncelleyin ve tekrar deneyin.",.. ERROR_BROWSER_REQUIREMENTS: "Taray.c.n.z minimum sistem gereksinimlerimizi kar..lamad...ndan y.kleme i.lemine devam edilemiyor. L.tfen t

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-zh-CN.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2044
                                                                                                                                                              Entropy (8bit):6.2736979749730315
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:3oeWvFbBQLSECfPnIuDfC9lI2S1lZmYDbVzzIKg+bGde:3obrYzCnnIuDfC9lIZmuRzzY+Ie
                                                                                                                                                              MD5:37C43CFE54AF2685411091B2CBEDB482
                                                                                                                                                              SHA1:553A5E8D839C2329BFD122EEFC7CA93F234E5470
                                                                                                                                                              SHA-256:42EB6FD7A4CF25446031658CB4EF096F8CB2CA044154E6817D1F6BB90621CDB3
                                                                                                                                                              SHA-512:C2DAF0CF5551AB494CC71ADAF00CCC173249D3C98C4D4F276A930605159AEAF488375B0B837C42EB3AE07E71328DFE59980A0DF3F86F6100135F69EF6B1B0EF1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.var _lrInstall_ = {.. EULA_TITLE: "....",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "...........",.. //{0} - Company name.. THANK_YOU: ".....{0}",.. INSTALL: "..",.. CANCEL: "..",.. RETRY: "..",.. //{0} - Product name.. PROGRESS_TITLE: "{0}.................",.. PROGRESS_SUBTITLE: ".......",.. COMPLETE_TITLE: "...! ............",.. COMPLETE_SUBTITLE: "....",.. COMPLETE_LAUNCH: ".......",.. ERROR_OS_REQUIREMENTS: "....................... .........",.. ERROR_BROWSER_REQUIREMENTS: "...................... ..........",.. ERROR_VERSION: "...................",.. ERROR_FAIL: ".......... ....",.. ERROR_DU

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-install-zh-TW.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2196
                                                                                                                                                              Entropy (8bit):6.291569327079189
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:3/svnWuIBR1EwNsIb5w6fIPlBZWe2jeemIuzlJIeqwBk7gxXtHT:3/Cw4wmIZfIPlBcaeJuzXjqwBk7Ez
                                                                                                                                                              MD5:4157882770B0354198215EA6FB536D23
                                                                                                                                                              SHA1:7990B23C1CCBF4A8DB88071ED139D4AB652FF4F5
                                                                                                                                                              SHA-256:7889E2D121AC0C178C0D4C4972E09D5908DC24332C9616C3E5C0196C3EB0A73F
                                                                                                                                                              SHA-512:C1E45371EE204626850ECA604FDB14F41CA16F552AC3D20247E80C72FA6C24C92DA3DE9EB96AB4B8C6FD496261FA404A8E20A3CE791EC91918065C3BBBF6D89A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.var _lrInstall_ = {.. EULA_TITLE: "....",.. EULA_CONTENT: "",.. EULA_TERMS_AGREE: "............",.. //{0} - Company name.. THANK_YOU: "..... {0}",.. INSTALL: "..",.. CANCEL: "..",.. RETRY: "....",.. //{0} - Product name.. PROGRESS_TITLE: "{0} ...................",.. PROGRESS_SUBTITLE: ".......",.. COMPLETE_TITLE: ".... ..............",.. COMPLETE_SUBTITLE: ".......",.. COMPLETE_LAUNCH: ".....",.. ERROR_OS_REQUIREMENTS: "......................... ...........",.. ERROR_BROWSER_REQUIREMENTS: "........................ ................",.. ERROR_VERSION: ".................",.. ERROR_FAIL: ".

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-cs-CZ.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):716
                                                                                                                                                              Entropy (8bit):5.601593746086543
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:7ekSSlN95i5kfx6v9LuO4biqra6fMocbkLwT5zxjAHo8+9wuRTopjzDVXe:7e9SlNLiaf4v9KO4zG6fMocWIOHo8+9r
                                                                                                                                                              MD5:0B89908B9923841B078CC61A7A76BC35
                                                                                                                                                              SHA1:D624DC0FD1DF78B4B76B12570075509A42FF109E
                                                                                                                                                              SHA-256:813C74E0D5436858145ECD92AC3E75494EC5B904B445D97D31269C8444B6A38C
                                                                                                                                                              SHA-512:380D422B64278B48F776DA567586968C31CB1634A740DF78BAC9133E5206B11A921DCB01C23C9BC0A983E94E30E6BBCD346C5D6DF22BACAFCCF43000BF81C7CF
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Verze",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Prohl..en. o ochran. osobn.ch .daj.",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Hotovo",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//A83452F2345A2C4F2349C965B2A2A0094AE73FC67FBDDA94359F307EB7FEE5276C3E6BC6A2EDCD79C863E8BD2C423CAFF61E90C886AA23029732F419C642DB91++

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-da-DK.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):728
                                                                                                                                                              Entropy (8bit):5.543169076160856
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:7ekSSlN95i5kfLYi6v9LuO4bikzbkLwT5zxjAHo8wN9wuRTo3UnIvtr2:7e9SlNLiafLYFv9KO4dWIOHo8wN9ZRph
                                                                                                                                                              MD5:27F9834F7FC9EDBFC8DA34938B7C2287
                                                                                                                                                              SHA1:52CFE14AD6DD70A8111FD38142EB82BB8132DFAF
                                                                                                                                                              SHA-256:30858A80BF1E8C0360A4E5CFF43A63508D8D9A7FD12232E81DA3EDFCE38DCB6C
                                                                                                                                                              SHA-512:3428D309CF0424AB69845E494757106CB2EDCAE9D6DF38B5DD9880F8E7B64CB87C4E0F51DC08B49F5C4722DD392F78F69DC8EF62395C49322EC2E83FDE3B9F69
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Version",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Meddelelse om beskyttelse af personlige oplysninger",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "F.rdig",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//DF97D3A674A022DA5BACF856741A2C92B3EE9B44F308152F8B4EE2E95FA17D053174A7E83663BCF4989EFCFEE2A0FF996EF931F303AC72214363112C4ADC2A29++

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-de-DE.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):695
                                                                                                                                                              Entropy (8bit):5.527109655785185
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:7ekSSlN95i5kfLYi6v9LuO4bi+p3ibkLwT5zxjAHo8+N9wuRTor8vgZyfVQ8:7e9SlNLiafLYFv9KO4pSWIOHo8+N9ZRD
                                                                                                                                                              MD5:13180ADA493CEB5435B479F834FE9E1D
                                                                                                                                                              SHA1:94A5B309C59AEB0B27CF71EECF796224DFC70DDD
                                                                                                                                                              SHA-256:9B2E9179A22743A963BC1CAA0AA577A6AF0DDE83B41052A107FFBA5D80E96A36
                                                                                                                                                              SHA-512:EEA1FC848A4957E1F1908DBBDCA1152977DA8EA07210DCD6CCAE2896C22CB79BC09B84E04059901E900EEFB97E1003346C75F9639DD433FD419C39B8C4CB6E3F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Version",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Datenschutzhinweise",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Fertig",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//28C3427ADFEF1624D0D9B57805257D515611DE1A2464AFC6562DF11F5F72560AADD348B26FCBBD09D60EAA89103ADEDA4FE3B91A708CC95680C05F2D23DA036D++

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-el-GR.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):750
                                                                                                                                                              Entropy (8bit):5.742473420151491
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:7ekSSlN95i5kft6v9LuO4bi7XKfRWkGmbkLwT5zxjAHo8JP9wuRToPvqSz:7e9SlNLiafEv9KO4mXCWkHWIOHo8JP9g
                                                                                                                                                              MD5:6ABD588F02AB9DB7AFC5331AB23FE5FE
                                                                                                                                                              SHA1:BE5D8B97DE267E17A6C7D1097BEE810D35854D68
                                                                                                                                                              SHA-256:766F6334D5122AE95035609D71F7B42E95079D2C44D137E9EA85996FB016DC39
                                                                                                                                                              SHA-512:A5B5FEFE8A27B0D7F9C41C45B207292F4B1B0AC67DE3607C1EE375F13BE0B0BA4AF05568C5C65AB5E6F81E69FA0F6576ECDD4601859EAFC5502A459EAAEF4BFC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "......",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "...... ............ .... .........",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: ".....",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//F2B0CD6B9BA0D430925E1BE53322D651876D13A012C3CBE23D1B95DF7DEF7F06DAA11E69FAE7CEA5B75195EAA15D414F173A4CB3C7C0C9E2810536EACBFFE55C++

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-en-US.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):688
                                                                                                                                                              Entropy (8bit):5.533507677264795
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:7ekSSlN95i5kfLYi6v9LuO4biqkCbkLwT5zxjmT9wuRToINYL02+MqiYm:7e9SlNLiafLYFv9KO4zkCWIoT9ZR9NY/
                                                                                                                                                              MD5:CDCA2F0FEE5A10002C226B11AC5CA5FA
                                                                                                                                                              SHA1:654A60C96E15C53489B6303B83A421BC011053BA
                                                                                                                                                              SHA-256:D5CAC847AFAC7105596936E5CA88B5621E36CCC5F93B08B799A64E258A97C113
                                                                                                                                                              SHA-512:815313AFE2731142A0079D1A7451AE0BD7BAD84946278AB0A8894FBEB1590D31811A09E154E8650995594142AEF2C2740CD37441F6DD612F4D6DC43E4733B42D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Version",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Privacy Notice",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Ok",.. DONE: "Done",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//B33C021EEC65FB9429503A5EC35648E261054E406325DD3E8F0E8CDCF888F6F3E8F11A3186BE6C9F5B2F72936617966B42903E177D672C318E16572F85514676++

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-es-ES.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):700
                                                                                                                                                              Entropy (8bit):5.521076185843457
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:7ekSSlN95i5kfri6v9LuO4bicmgnbkLwT5zxjcglP9wuRTog0tm0U25gbJO:7e9SlNLiafrFv9KO40gnWIqgV9ZRb6UY
                                                                                                                                                              MD5:421E0D6F0AF028DED36C9299FEDC0A17
                                                                                                                                                              SHA1:176E7BF98B428A0CC2A669F5015A49163DF6FDB8
                                                                                                                                                              SHA-256:72C338FBD5F512AFCC8BC340A41AF5BB155FDEBA6095C221F0DF6B51D481C04E
                                                                                                                                                              SHA-512:A6078DC7B30B3CC383312141FAA0CEE31343332401B7D5FB80396008032F91B72D5C6050828E58AF08100624EB1BC8563CCB09AFB504B3800AC2B2E0373CB934
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Versi.n",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Aviso de privacidad",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Aceptar",.. DONE: "Listo",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//5C69317B82A59B50E7C708BC7F21B42E5182E90E1C02230716EDB2AFDAE89F0B163A303E5D1C6BA4BE40CA7AEAEE2D7D9D1CF46901878A77ED5F13393CD34B43++

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-es-MX.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):700
                                                                                                                                                              Entropy (8bit):5.538214104466149
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:7ekSSlN95i5kfri6v9LuO4bicmgnbkLwT5zxjcglP9wuRToZQbn3h4UN5/pQRn:7e9SlNLiafrFv9KO40gnWIqgV9ZRlTO1
                                                                                                                                                              MD5:F4D3CBC1628D13B5C09E2476EBE80B10
                                                                                                                                                              SHA1:2130D9055D228CF5A835A533AF9A6461BBA92300
                                                                                                                                                              SHA-256:48E38CF1A6B47820BA0056AE6ECC8E0901642583CA655A1F9524DFD6FCBD9481
                                                                                                                                                              SHA-512:73A626D2AABAD17969FEDEF8343CDC098667D493AF560EDFCE00A85D96FB0FA326AE37827B18EA2AB897DC34C442E32592D048B0CD3C613AEAC0A035EAED3B6C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Versi.n",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Aviso de privacidad",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Aceptar",.. DONE: "Listo",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//07231EDDCE5FBB59AA1A1515B263F8049CD835BA6C8F80B7CCC7D1C2E774FDD8DC0354E9066A60E4C1FF036474B0D8D29B447399D723F4D71B33FD1C3E99E522++

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-fi-FI.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):692
                                                                                                                                                              Entropy (8bit):5.533019484489134
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:7ekSSlN95i5kfft6v9LuO4biu6gbkLwT5zxjAHo88WN9wuRToi9i2LfEEen:7e9SlNLiafsv9KO4RWIOHo8Z9ZRLgOre
                                                                                                                                                              MD5:A58D3617FAB055A5BB2F853DC20E162A
                                                                                                                                                              SHA1:657760BDFCB4BC1B792FB4BA311F29A1BEBBAA05
                                                                                                                                                              SHA-256:775BE97D1D292AF2E9AEB273F3762110F24E3EF5C274B76276650EA17533C5A5
                                                                                                                                                              SHA-512:743D624E0B2739F9912361003B0FCCC2C5C186242C4DB8AA910D8568E85055674F2522596776E3DCD618B9C8DFC114B3B558138A8ADBBF34D3D47A2291720840
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Versio",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Tietosuojaseloste",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Valmis",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//E481127624D07EB74C8E3EC12E98D211135713F7CB376EB4067EE75139528F62A29C9D0911341F48F321EC238D02C021BC1290D447840FF68CABE0390EFA6211++

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-fr-CA.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):710
                                                                                                                                                              Entropy (8bit):5.553457378961235
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:7ekSSlN95i5kfLYi6v9LuO4bi+QdbkLwT5zxjAHo8g9wuRTokK7lyT:7e9SlNLiafLYFv9KO4QdWIOHo8g9ZRgU
                                                                                                                                                              MD5:8F60B57E17F9355BD7CCAD5B7BD9151E
                                                                                                                                                              SHA1:C056D67CC1AD5F55B54BF91D7BD54A6E148A8F7E
                                                                                                                                                              SHA-256:F2A49D540C69D6397EA266BAEE6D88B07CE8376E0A0ADD8D52E30DD58CFA7EE1
                                                                                                                                                              SHA-512:B4B9D67C83A88098858F31367BE3A5B6C31C9C146C104BBE2974735DEB5771D554328286AFE298F9C981DB1C4DE17C69A14B6F71908EAC2394A319B0750800F7
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Version",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "D.claration de confidentialit.",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Termin.",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//E3BD8AE08C988C907078B9F200889EA077677D39BD0629B0BB45DEBEBFAB3B2623D7D9C4E14479C7AEC8806098FEEB2D6E9551C1C5E91D0B5B4714909092B133++

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-fr-FR.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):710
                                                                                                                                                              Entropy (8bit):5.551524429727153
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:7ekSSlN95i5kfLYi6v9LuO4bi+QdbkLwT5zxjAHo8g9wuRToeJ41r3TdcYr9cudd:7e9SlNLiafLYFv9KO4QdWIOHo8g9ZRBC
                                                                                                                                                              MD5:9A3B60FBEB2DCF18589E9F4F62402784
                                                                                                                                                              SHA1:903E1EC996C509F0FB561197EE8A4819172127DC
                                                                                                                                                              SHA-256:48DB36C65E163C79F142CA141158F27CB5AA04650DE34BC0140B2F5F21AE9626
                                                                                                                                                              SHA-512:F6479F8736E359C3C1ECE29D339115863176E8F7092EB4FD965396570101FBB9695708099C201321FEE33070E37A2D7A9B8CCF4C88052C28A845E678E558EDE7
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Version",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "D.claration de confidentialit.",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Termin.",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//4300BAED7129CD9A488D64857414FDEAEA90A2ED961B85467E428C180C405D36176B5C33881FDF571E7CB431BDE56BAAB657CA54C754F049A4C89DFE1375AF28++

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-hr-HR.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):703
                                                                                                                                                              Entropy (8bit):5.536703499003314
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:7ekSSlN95i5kfv66v9LuO4biaBzcbkLwT5zxjHT9wuRTo/RRGq6caRQ5EhX8:7e9SlNLiaflv9KO43BoWIVT9ZRAv6cao
                                                                                                                                                              MD5:6706E83F2A59FAB5DEFBDFC80F4633C7
                                                                                                                                                              SHA1:EA472DF3871AB10016A5ED98ECED50541D694B54
                                                                                                                                                              SHA-256:DEA7E336E0876D5DAE17E8348D6ED13BB4ECD68D5A86EFFE0ECC929DEC44A4DA
                                                                                                                                                              SHA-512:A1EAFE8784CBB8EAF788E2091C46995935B65D651C4C88AF17991C33EDEAAF25686FD5A3961E578E830869D7AEF9E92120D0E17A892AF164666DE143BB7A7760
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Verzija",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Obavijest o privatnosti",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "U redu",.. DONE: "Gotovo",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//EA0F48B5ED4FE04CC2C2AF47C1B43492B45D017E1312F3817E9F43E2C1D221AA90FF24BF1595452E839B1DC7D1E78A310A44B8850AC455B42461845FDACF6A06++

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-hu-HU.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):699
                                                                                                                                                              Entropy (8bit):5.604989427690044
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:7ekSSlN95i5kfQdU6v9LuO4bihIHmdcbkLwT5zxjAHo8Kwv9wuRToqoU1CBRO4qT:7e9SlNLiafQd7v9KO4k6ocWIOHo8Kwvj
                                                                                                                                                              MD5:FD4C541E933E611686ACCE6E74C8188B
                                                                                                                                                              SHA1:8E24F6962321BEEAC1AFF3FBB8752452721D9CD9
                                                                                                                                                              SHA-256:3A19120FA0F231EEA387E3B3669E2703760E3A78865EDF7FA5D89FCBD2FF25EA
                                                                                                                                                              SHA-512:733A7663AA40A82AC67198E4714A88C4E34B824BBFFA30E94DA037FCC356DA02630776B5768C9F35F304F554BADDDBFB25944E80FB3740D9674F601A67740F75
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Verzi.",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Adatv.delmi k.zlem.ny",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "K.sz",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//2B0C360DE3C421814F2E188331FE299D9009B5E52A5F774448EA6EFA01D23F1D82B783F980A30307E44ECAA537C1E17DF7F6139590BA395D50649B1B654C37D9++

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-it-IT.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):697
                                                                                                                                                              Entropy (8bit):5.5339394018129155
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:7ekSSlN95i5kfy6v9LuO4biNkbkLwT5zxjm79wuRToenGsyLG8O:7e9SlNLiafVv9KO4akWIo79ZRvnYC8O
                                                                                                                                                              MD5:64A1D1E0662C24EDCC35827A789D4FEE
                                                                                                                                                              SHA1:70FFD3436FFC32871F25E04D3FE7F9E68433CE7E
                                                                                                                                                              SHA-256:16B89AAB5121717EC50BE9C8B0D26E6F832B06EFF6F5CF1868D186FE4AA44847
                                                                                                                                                              SHA-512:2252D5C6819873C48FD100C234D5786AEE91733011AACFF43A8635E9E2675E96DF388B60F28F695864E4922E06293AF323ECD9857A04599CD1AFC7D9B0BA3078
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Versione",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Notifica sulla privacy",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Ok",.. DONE: "Fine",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//770EBAFC663CC00C514D1F9010B42BDBD04D37F1AD0BC9C79D4CDBBC4054AF7576772A4AED3B9870073FAC420F7B42E186D89D9994D019FB160E25887AC993E6++

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-ja-JP.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):808
                                                                                                                                                              Entropy (8bit):5.755434563684229
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:7e9fLdo5ijdfA6Dlv9o4A2AWIOHo8UHv9ZRdvkjFL:K9fLdICdfA49XLAWIOfUHF29
                                                                                                                                                              MD5:F5A1ACE8F296A73C98C1DC5B8A7BEF20
                                                                                                                                                              SHA1:450E37207D32F1F1A22BE869CEC3036B84394B71
                                                                                                                                                              SHA-256:9C234581B46B79AB4EE16087438DDC9ACEAB936107837A7A0A3D330DAA521600
                                                                                                                                                              SHA-512:A7A1661FFA4AF4CAADAB32AEE539CCF016CEBB26F68FE4B9572DCA1E50DC5BFAD56496A3EF02B1FC2F5B741EF22ECF2A27FBEFE8C2E7E20D22571AAB9F4D3978
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:var _lrShared_ = {.. PRODUCT_NAME: "..... .........",.. PRODUCT_NAME_LIVE: "..... ......... ...",.. PRODUCT_NAME_TRADEMARKED: "...... .........",.. VERSION: ".....",.. WEBADVISOR: ".........",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "........",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "..",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//325246946CDA56950DEB94C2DA9F2EA6B5778C9FED260053332B11D35345B63F923274D8B22D3CA74A0E69F17D81B9C810E65F9C6075E600331EB913960B0F87++

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-ko-KR.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):742
                                                                                                                                                              Entropy (8bit):5.839697223679954
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:7ekSd6ds63i7R6ikfV/i6v9kc4biyGbkLwT5zxjsGiFW9wuRTo3c27FM3CdVLZYY:7e9Ed13isnfVtv9kc4sWIViQ9ZR72K3+
                                                                                                                                                              MD5:6145E5BB1586E60D0684FE9603B9A68B
                                                                                                                                                              SHA1:DB6143DD2F527BC4BA3126ED9B04CA258835EAE9
                                                                                                                                                              SHA-256:009F99CF372F66C5C749B33B03C4BBDBF27BD190C3E255C4C4071A54BB8144E5
                                                                                                                                                              SHA-512:2CF2775D0B9A43C73E2AC8F81D005C4E9F048383EC0040FE10F5D32A1E1C17CF81E1F0483C20C3B3F370BCD4A1BA0B39DEC7FACD4FD38B0541977EB51AD74006
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee ......",.. PRODUCT_NAME_LIVE: "McAfee ...... ...",.. PRODUCT_NAME_TRADEMARKED: "McAfee. ......",.. VERSION: "..",.. WEBADVISOR: "......",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: ".. .. ....",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "..",.. DONE: "..",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//11977E24911F19DC010F3559F3FA535DB325EB809FB7861C71DF7AA30F16D62BD6F45D6173C6F30142C017AF744E8B374F099021954AE722D81DE3F285CE1653++

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-nb-NO.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):696
                                                                                                                                                              Entropy (8bit):5.555002828102086
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:7ekSSlN95i5kf3Hi6v9LuO4biqyNLMBHbkLwT5zxjmf9wuRToPxa4e:7e9SlNLiaf3Fv9KO4zyNsHWIof9ZRaS
                                                                                                                                                              MD5:1F20C47B38B96AC8D05CBF523BC6FEEC
                                                                                                                                                              SHA1:751154E4DCEE2F3511AD41FE3AEE82943E2DB486
                                                                                                                                                              SHA-256:24C2DC1177700662375C23EF2560E78531EE57A7CC6184FF49EEC59D52977E66
                                                                                                                                                              SHA-512:98952B54CB9083E6FB9124B8575740365298E222A3234AD1BD43CFB799186D1C06600DDC75FDE140CD64624302448AE6C4B9324FD2CFFB8C5D24A8D1DB4494B8
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Versjon",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Personvernmerknad",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Ok",.. DONE: "Fullf.rt",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//41459AD0D946DEA470DDB8E06123D1FFB19C0E18F6ECA17EAC1FD63746A0F9817D877856C47B40719A8E3BD18D57EF2775BA025CFD5D84E190BC869761BB1B92++

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-nl-NL.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):746
                                                                                                                                                              Entropy (8bit):5.618360741614376
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:7ekSSlN95i5kfP6v9LuO4biqLEnbkLAWB2CT5zxjAHo8CW9AWB2CuRToAC8KBr8C:7e9SlNLiafyv9KO4zLEnWtB26OHo8CW3
                                                                                                                                                              MD5:87072653FB74D1908207D69E7D55D64C
                                                                                                                                                              SHA1:33943BC06E874027B1C1E0D27521CB8946DA1FE2
                                                                                                                                                              SHA-256:0152344CD0A7A07D4DCAFFC965F7A15545976A6849A31A4CB73728E61D50BDC3
                                                                                                                                                              SHA-512:EF33A09E56054E49B4ADFE9077744FE9E30C7A2D499331BB8AA3E2C909C937FF80C4521F9A44442D585B047F61D0425D06473A1856830795024C016572D2C257
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Versie",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Privacyverklaring",.. PRIVACY_URL: "https://www.mcafee.com/consumer/nl-nl/policy/legal.html",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Gereed",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/consumer/nl-nl/policy/legal.html",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//301C093FC94AF26D8AE7B05918D20E229418DBCE3795663BF8928A7CE18912A10D142EC829510A9A04DD3DE4982341227995E870D355FB1730172F8827B52FA7++

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-pl-PL.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):709
                                                                                                                                                              Entropy (8bit):5.573815762997186
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:7ekSSlN95i5kf6v66v9LuO4bipidGGnbkLwT5zxjmO9wuRToEtCYdhUeOrtQc3RH:7e9SlNLiaf6vtv9KO4oMGGnWIoO9ZRB+
                                                                                                                                                              MD5:88771C970F7A4F18EC8AE28CCA429782
                                                                                                                                                              SHA1:4A2449500C475DD4B93FF65403895D52D954B957
                                                                                                                                                              SHA-256:51E16B7794A918B01A6CEC2067DE1A996D90D5F00C4748E3C2F7B0693CF13D65
                                                                                                                                                              SHA-512:9167BCA95539CE5C5A0115A622AEE4F82B47FFA4A81C5C07F84841FE13247972D4517940F38D64A9EB95BA766A309F5A47C7E1DF03479266F7A89D056614934D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Wersja",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Informacje o ochronie prywatno.ci",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Ok",.. DONE: "Gotowe",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//3A84AB0418B2ED1B5B81D07F8FDA8236BD73D737F7AB5451E06ED65F6956634E9DDC989280EB4F76239C2B11ED925F7520678D515016BE528E8770EE4A962640++

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-pt-BR.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):700
                                                                                                                                                              Entropy (8bit):5.535609678454076
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:7ekSSlN95i5kfqX6v9LuO4bicmHbkLwT5zxjAHo8kf9wuRTo40CjGMAsk0pZP:7e9SlNLiafBv9KO40HWIOHo8K9ZR70Vi
                                                                                                                                                              MD5:1F64A40E7A9BC0AB0DD1E8C65BF01EC8
                                                                                                                                                              SHA1:5686E13753A3ADFEE18586EE21C616CC2A8BED27
                                                                                                                                                              SHA-256:8BB0816F2F987865298ED4CFE2944D6CCEC54106C22D29E38EFCDF9CC35BC72B
                                                                                                                                                              SHA-512:A9A24501FC5A905C855CBDF8345EB39DC14DD4E0733F7E2BC7B89F9BE880CF06C4C0ED92FDACF164CE2EBAE12E4E96F3DE91A74986DF1F9FB5D076F1E7DF9866
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Vers.o",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Aviso de privacidade",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Conclu.do",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//C6BD7E4019F9E0D1EB083D3F584B5BCC945958F93B955C8D251B8063EC97EF01B3A1598FEE8B34F5088411CA783991C7150E5A8194D99601FCA58CA958FBCFC6++

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-pt-PT.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):700
                                                                                                                                                              Entropy (8bit):5.545593623114569
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:7ekSSlN95i5kfqX6v9LuO4bicmuybkLwT5zxjmkf9wuRTo+1V+1lcg034:7e9SlNLiafBv9KO40nWIoK9ZRpVqP034
                                                                                                                                                              MD5:1445BF7350A43EA04B5137E30E098660
                                                                                                                                                              SHA1:ECE4618BB23257BF4FF3987BB2BA973C9DE39ECB
                                                                                                                                                              SHA-256:46E378FAEE2557424B89A183055E0B2B837A3BB3FE2A5D4752070AEFD179E042
                                                                                                                                                              SHA-512:CD658FD73E8D6B41C4D40D6056074E022C29B81295CEE969699B3524483C4E621EDCD9146BA986510077841C119C17F72CD5780ED5BC5A160BB9BD8E06E66E4D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Vers.o",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Aviso de Privacidade",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Ok",.. DONE: "Conclu.do",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//BE7464082330798025F0199F27B7F91B58BA20E70FC7AD8F536330D976A1C8A0BA50BF0CCB7C8ADEE56E1B6DDDA64083DEC8292DD2A5D8FE7BFB052E5DD37472++

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-ru-RU.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):751
                                                                                                                                                              Entropy (8bit):5.736247545245662
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:7ekSSlN95i5kf96v9LuO4biq0epiXbkLwT5zxjhKgE9wuRToRhJbKAJ2Ikjdylt:7e9SlNLiafUv9KO4zrWWISt9ZRCbKC2I
                                                                                                                                                              MD5:DE492E461461D3D52AA08F1A65E9450A
                                                                                                                                                              SHA1:ED808BB2463CA06BFFF0E5B82943E5BB42F74A55
                                                                                                                                                              SHA-256:BF40C0B4DC0EB8AA4858B4D0E72C15432BD4BCFE58AFFFD62CC0AA87699209BA
                                                                                                                                                              SHA-512:DA0B738108E2FD7D28AA066735D767AA04CE45FECC672D2733ECCF2C70BC01E0527693739E31FABF839A3973478AF405FC61000D0DE6ADA0FFE056BBC2BEC961
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "......",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "........... . ..................",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "..",.. DONE: "......",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//E4A5168936DC799561519C4BCEB27FB141BD339FE4E4616D9827D54B350B4C929A1E4E8AF118E4B76DCA7650ED8D1DDB576EEA5495CA4D85D09DEEBA67F50D2C++

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-sk-SK.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):719
                                                                                                                                                              Entropy (8bit):5.625490495192042
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:7ekSSlN95i5kfa6v9LuO4biIAbkLwT5zxjAHo8+9wuRTo0E2XKYTdi4:7e9SlNLiafNv9KO4uWIOHo8+9ZRVVHi4
                                                                                                                                                              MD5:96904C1DDADF77DCA9C4E78B6CFDA54D
                                                                                                                                                              SHA1:05851A1C1D489715CB9D205C6C2011FE776EDE09
                                                                                                                                                              SHA-256:9B63E802BB23DCB17DA7ACB49A9C60C2445EA11D06BABB5AC2DE761D091554CF
                                                                                                                                                              SHA-512:08109C780BBD173F5B82677CE33886219825FF77DC554C2E96A75B6050FE567EA264084CDB5F24D875FEE5BEEFF34002B56F749408CA1975C1FD13F02C06D52D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Verzia",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Vyhl.senie o pou..van. osobn.ch .dajov",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "OK",.. DONE: "Hotovo",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//F0684513FFCEF181ED233F0874BE126A929AAD7DA7DA301345413131F0E240AC260FB902BF7853768432D1E4612A5D055F37A3C30F26E1A665F5022574E2107F++

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-sr-Latn-CS.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):706
                                                                                                                                                              Entropy (8bit):5.557259676526922
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:7ekSSlN95i5kfv66v9LuO4biagkcbkLwT5zxjHT9wuRToIKOI+k5Da:7e9SlNLiaflv9KO4cjWIVT9ZR7IX5+
                                                                                                                                                              MD5:0FEF3FAB6D9A0C97B30839742C754152
                                                                                                                                                              SHA1:3C7A2FE8D970724C01B1F4D48C4275C70880799F
                                                                                                                                                              SHA-256:3A9AE5E3BA5979C6EFB8ED0EF76696BECFD28C25DBDA70F1F1FD718F7F779986
                                                                                                                                                              SHA-512:9B4FCA728E44D47693FC10EDB81185FD07C0EE01A205D6979F8756B517626287DFC84D05F47F3E21B89F825FE9533732B6DFBC775D70E9CF43CEE9685D1B94B8
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Verzija",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Obave.tenje o privatnosti",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "U redu",.. DONE: "Gotovo",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//AFEE562616B11887136C41C6ED7E9121598A1FF4AE95E6DBE468A42F7144C5D799776DF69DC7BD6332B25B049F1AE29FD2F45BF99E7B31090679D41DF5C3B4FA++

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-sv-SE.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):690
                                                                                                                                                              Entropy (8bit):5.533733246233637
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:7ekSSlN95i5kfLYi6v9LuO4bieGbkLwT5zxjmf9wuRToTrY9eNIEAyHeF:7e9SlNLiafLYFv9KO4JGWIof9ZRDe9Q
                                                                                                                                                              MD5:2771C3116FBB6090FB973E58E6CFC622
                                                                                                                                                              SHA1:54A74866A219AEE1A036109A33379D4C35B02126
                                                                                                                                                              SHA-256:B071664D70F0D38B19D9F37ED0D1D1543F8A4A6BA73D1DB0FC0E10787B1460FC
                                                                                                                                                              SHA-512:F0255F361362870734C0CE416378BD45BB11B384DA7472AA17DF0C9A83BD42E08F9FB34A6F7EA53B300E51F1DC96834F1A5838215ADEC26EE829346C059D19B4
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "Version",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Sekretesspolicy",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Ok",.. DONE: "Klart",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//F0B053D6B4B6EB77B464AEE2EC062F3B4016EC5E597CA183B278981E2145F5A893ECE084929E5CA5621BE4D48D8E755C04DB6B1FB3DEB573B5F8658C1D76B864++

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-tr-TR.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):696
                                                                                                                                                              Entropy (8bit):5.555248781331317
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:7ekSSlN95i5kfT6v9LuO4bij2VbkLwT5zxjAWoN9wuRTo7TzlrnLWc:7e9SlNLiafGv9KO48QWIuv9ZRQric
                                                                                                                                                              MD5:60740DB4AE5041229CBAA8128AC860AF
                                                                                                                                                              SHA1:444B4D3EDEE4C3DBD3B3CB047F5E9FACCC32BC10
                                                                                                                                                              SHA-256:1E97E284E0956DDB25D8CF48C4CF72BBC5BCC151C4A15CE67E104900D9F01CCB
                                                                                                                                                              SHA-512:39A26A3B2C478563BF56830A51C8309FBE419CDCED60EF3035C69180732BADFD494F9F9177E14D7F7AFCCB1B2BD3084D10DEB5DB27A982D73061411C368A36FD
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "S.r.m",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: "Gizlilik Bildirimi",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "Tamam",.. DONE: "Bitti",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//733CB7D8A9EFCC0CF18B589916BFEE01F5CF620EAA6E9960393E5C49750DE129FAB789EC89029209A4847CB29FE227DB5C32123970205692D05853989C95CE71++

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-zh-CN.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):713
                                                                                                                                                              Entropy (8bit):5.892218933811275
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:7ekSuKxi7s6kfF6v9bgbiE4ebkLwT5zxjtDYv9wuRToutSkdvccCqtkApTZTKr:7e9uui7s/fsv9bg/HWIv49ZR9tnccjkx
                                                                                                                                                              MD5:DB11A69C2C44355CB68BE1E48A779DA3
                                                                                                                                                              SHA1:3D50CD6D6F1C3DA277C4DC6E15A75CD7907ED22E
                                                                                                                                                              SHA-256:C077F95FDEFDC67447B0DF0B2FC100DB3A585F7A0C98A7EBC9FE65B9DBBD1307
                                                                                                                                                              SHA-512:2B712EFB4AB936DBE0484B60AEFC868471A61B4404AD6FEF0C75CBD83D08DA712A352FD00A0A2AFFCCE62DED6720EB3770DCD7469216220A8EC277FCCAC90537
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:var _lrShared_ = {.. PRODUCT_NAME: ".......",.. PRODUCT_NAME_LIVE: "..........",.. PRODUCT_NAME_TRADEMARKED: ".... ....",.. VERSION: "..",.. WEBADVISOR: "....",.. COMPANY_NAME: "...",.. PRIVACY_NOTICE: "....",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "..",.. DONE: "..",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//AA3DFE3EB0DF4209BE30E72A37AE78E3FC5A020C813A2FA5752282111D4330F54EA1B79FD4FD4C19C8CD2D5D72395742AF2324A780CB07031F9F479D5DC3BA23++

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\jslang\wa-res-shared-zh-TW.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):694
                                                                                                                                                              Entropy (8bit):5.680060936829599
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:7ekSSlN95i5kfF6v9LuO4biP3emebkLwT5zxjgDYv9wuRToKJrOJs9FX6H:7e9SlNLiafsv9KO4d1WIG49ZRpOJsbXQ
                                                                                                                                                              MD5:6E447B71DB01CC16CBB10BE7DF49D710
                                                                                                                                                              SHA1:9AABBA20D6DBADA8E59DFDDFF4A6AE9FA7D20421
                                                                                                                                                              SHA-256:5458F05BB2B6F2C59AC899826BC15CC160AD9D524948734DA1D6A660737BE5D6
                                                                                                                                                              SHA-512:94594648756C6A23C77189BA91EF3E60C22E768A8E2DAE2AF6DCFF373CE1C7DAD22FFA3B081DED0780CBF033B1ABCCD856A6DA91BF8A58799A33146702C48EDE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:var _lrShared_ = {.. PRODUCT_NAME: "McAfee WebAdvisor",.. PRODUCT_NAME_LIVE: "McAfee WebAdvisor Live",.. PRODUCT_NAME_TRADEMARKED: "McAfee. WebAdvisor",.. VERSION: "..",.. WEBADVISOR: "WebAdvisor",.. COMPANY_NAME: "McAfee",.. PRIVACY_NOTICE: ".....",.. PRIVACY_URL: "https://www.mcafee.com/legal",.. CHROME: "Chrome",.. FIREFOX: "Firefox",.. IE: "Internet Explorer",.. OK: "..",.. DONE: "..",.. LICENSE_AGREEMENT_URL: "https://www.mcafee.com/legal",.. COMPANY_NAME_TRADEMARKED: "McAfee."..}..//DCB52ACE57E8AA534E6690F40AC43DD7AF2FED37B1D9FA31AD396FDDF586514219C10F0873F31FDBED3CE0FCEEF11949A7647F03D42823DFA4509DE1F8791412++

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\l10n.cab

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Microsoft Cabinet archive data, many, 259114 bytes, 513 files, at 0x44 +A "\l10n.manifest" +A "\jslang\new-tab-res-toast-cs-CZ.js", flags 0x4, number 1, extra bytes 20 in head, 39 datablocks, 0x1503 compression
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):280554
                                                                                                                                                              Entropy (8bit):7.934998622289322
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6144:9ZODORly5IfRB/+dCnXu3sW/khjw7u4AL+k4O3:mORlyCffuAjKuvqu
                                                                                                                                                              MD5:18A3B1780F6A6CADA523649CBDEFBD84
                                                                                                                                                              SHA1:0DFC1DC0523C52CC8C4D9B1939FA6CB31F7A51A0
                                                                                                                                                              SHA-256:E4C6BF9FA6A795E6C4A50EA31EE221608F2EE1F90C4958C88F523043070345BF
                                                                                                                                                              SHA-512:8B85D40F7797EDB0BBD1889D1AE19C8D176F769AB1E038DBA36E93CE6380D42629599452ABDCA51C9612279866280EDB62C093E4F0F2590A5F371324445A4A0F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MSCF....*.......D...........................*....S...........i..'..............X4{ .\l10n.manifest.#..........X.z .\jslang\new-tab-res-toast-cs-CZ.js.#..........X.z .\jslang\new-tab-res-toast-da-DK.js.#..........X.z .\jslang\new-tab-res-toast-de-DE.js.#..........X.z .\jslang\new-tab-res-toast-el-GR.js.#...!......X.z .\jslang\new-tab-res-toast-en-US.js.#...D......X.z .\jslang\new-tab-res-toast-es-ES.js.#...g......X.z .\jslang\new-tab-res-toast-es-MX.js.#..........X.z .\jslang\new-tab-res-toast-fi-FI.js.#..........X.z .\jslang\new-tab-res-toast-fr-CA.js.#..........X.z .\jslang\new-tab-res-toast-fr-FR.js.#....".....X.z .\jslang\new-tab-res-toast-hr-HR.js.#....&.....X.z .\jslang\new-tab-res-toast-hu-HU.js.#...9).....X.z .\jslang\new-tab-res-toast-it-IT.js.#...\,.....X.z .\jslang\new-tab-res-toast-ja-JP.js.#..../.....X.z .\jslang\new-tab-res-toast-ko-KR.js.#....2.....X.z .\jslang\new-tab-res-toast-nb-NO.js.#....5.....X.z .\jslang\new-tab-res-toast-nl-NL.js.#....8.....X.z .\jslang\new-tab-re

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\logicmodule.cab

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Microsoft Cabinet archive data, many, 1540779 bytes, 2 files, at 0x44 +A "\logicmodule.dll" +A "\logicmodule.manifest", flags 0x4, number 1, extra bytes 20 in head, 136 datablocks, 0x1503 compression
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1562219
                                                                                                                                                              Entropy (8bit):7.9996062016214085
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:24576:Hu0x4grXHJRgWxJ/HvN93qQRbueXhJj3jVnspU2e/+AOIWCd6/Po:Hu0xsKHvN5qgbJXhNwte/+AOSmo
                                                                                                                                                              MD5:69E6EF3F7B28E60CD12D20A10FA64F75
                                                                                                                                                              SHA1:ED16BAE3DE96CE25CB87478AD49AF79F0E74990F
                                                                                                                                                              SHA-256:29AE246E374B62911F70AF58B311D37A4FD08F43C477F65317549890CE645067
                                                                                                                                                              SHA-512:1244326E7D8BC8F71E4CBC1C4505363B0D9F562C372DAA4ED398531AD6F1C9359BA34AC17BEF61000E6500C574F96F8D4CFECA177448D5CE49583B1B1A22C80C
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:MSCF............D................................S.................. .C........X.{ .\logicmodule.dll..... .C....X<{ .\logicmodule.manifest..R...+..[...3 X...@d.6......_.i~cRj.b#.4..H..F.v..H......Y.t...........5...i..}.A.:..P.@.fh.h....................bV.....ml.B.b......,..9....y.o..gw....{.Hv[.K..q.7[.M.]d.K.rc....+...m..T.4..Dz..@P......I.D/._..@....l.h..9...W..?.^o@..VW.}#.........9.<.........ir.NY..8?_. ....,..|.[.5.r...n..[%.".y..}...w......S./..W..........y.o....,9.|...:.{..rw.j.O7.]X..M.;u..O.5/\.y...W.w..n.z...7...T...?.W.)....Yn..C...{|..m=]..z..7.5%u?....}.wt.....6M.....F..vY.o..;......\....2...5.._s:..f...`?'..]....?......M............/..r....r.._...i..h....|.;....FFW_v.....p.._9.N....w........5.....?...x.B........wM\........k?....6.,.......5..g.,~.....k.I..x..@<.|.......K..\.......V.yO\r...M..+..9..u/.B.!.9...w...i.-'....Z..xxc.g..3]fzc[..4....u..j.....{....+...`.0.3.~..~N'g....ke..48.=K.}..A...4..{..vq..!.>..

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\logicscripts.cab

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Microsoft Cabinet archive data, many, 42546 bytes, 26 files, at 0x44 +A "\logicscripts.manifest" +A "\logic\aj_logic.luc", flags 0x4, number 1, extra bytes 20 in head, 4 datablocks, 0x1503 compression
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):63986
                                                                                                                                                              Entropy (8bit):7.93401090353979
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:ts54nCZFpp0BDGY9kS7YGxf4izxd7ExLD:tlkUl54m2D
                                                                                                                                                              MD5:54523C686D7521FEBF299C44554567FA
                                                                                                                                                              SHA1:3A5BEB7D73CCC17CA628D68AB366102BB3292FAA
                                                                                                                                                              SHA-256:007B45D2A89307A9935611A17170DB01377E24D9B258DB2471B8C78A6DBD1398
                                                                                                                                                              SHA-512:33A4C254FE77EFF877A7662974AFEA0A05072244C19DD20175DA45567131BD8BFD0442DE71AE002F8A43A64DCC9FE3EDC38431EB5D53584BCFF2357878667A6C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MSCF....2.......D...........................2....S..........T..................X={ .\logicscripts.manifest............X={ .\logic\aj_logic.luc............X<{ .\logic\base_provider.luc............X={ .\logic\edge_onboarding.luc.v..........X={ .\logic\ff_monitor.luc......<.....X<{ .\logic\logic_loader.luc......H.....X<{ .\logic\miscutils.luc./%...Z.....X<{ .\logic\oem_business_logic.luc.}..........X<{ .\logic\providers_selector.luc.D..........X={ .\logic\ss_logic.luc..'.........X={ .\logic\tests_logic.luc.....{0.....X={ .\logic\type_tag_utils.luc......9.....X={ .\logic\usage_calculation.luc.%...uA.....X={ .\logic\oem_utils\affid_monitor.luc.0....F.....X={ .\logic\oem_utils\oem_util.luc.0....H.....X={ .\logic\oem_utils\oem_utils_wps.luc.Q....].....X={ .\logic\oem_utils\oem_utils_wss.luc.....Kg.....X={ .\logic\oem_utils\oem_util_selector.luc.o....i.....X={ .\logic\providers\bing.luc..F..Z......X={ .\logic\providers\yahoo.luc.c..........X={ .\logic\smart_toasting\smart_toast_api_request.luc

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\lookupmanager.cab

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Microsoft Cabinet archive data, many, 987893 bytes, 2 files, at 0x44 +A "\lookupmanager.dll" +A "\lookupmanager.manifest", flags 0x4, number 1, extra bytes 20 in head, 91 datablocks, 0x1503 compression
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1009333
                                                                                                                                                              Entropy (8bit):7.999358489544993
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:24576:x9iHrHG4QEQZ4BNSN45K38o/u9iyqVqbUc4gR9UuTvhY:xgHrW3ENzK3812EU4T5Y
                                                                                                                                                              MD5:16E6F6D2D6D21B5A77158DF705067A09
                                                                                                                                                              SHA1:E622926049E7C8595B35A9A78A17280930F8FC24
                                                                                                                                                              SHA-256:A74314741747AC50C8A2710E979B599B889AAC6C0C023521F838A5A5419357DC
                                                                                                                                                              SHA-512:0FE89B0DB5067FA270DBF4CB8B1F41FBE4D08720EABB00002E17D4FB0224479E15D88D13F1C0E1979D7E7BB4E6513DC4473FE7800C98CA4E5B6B59E123497EC9
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:MSCF............D................................S..............[....L-........X.{ .\lookupmanager.dll......L-....X0{ .\lookupmanager.manifest.`.:.....[..., Jt...@3. "....%.X.$.<...y.r#(N.@. nG2H0..I..9...Ar.P.. POnr.r.d../..;.'..S.....?..h@hh.....{.=......ys...B..k`[.".i...GK....c.3k+.sYu+.r.{.\..E....`.... ..dh.D]BS.l....+ E:.. .F $.!X.%.H_......@...T..B..s......^...R#5..%.j}.N%..T.mW.S...O....g[...[...v.T]..l...].6..xD..~..H.H..r7../.......S.%....r...~[..}?E.r/..'....~#-.I.<.2.......s./gk.?.m........W..|$e.k....d4......t#.p...|..._..O....m..p............N..b.#D...O.[...^../}s.N.....n.`G.........<..l....?.v.K........z.x#.=........lg..Z?.....w..P.......M6..a_.G.V.Z...6.......fe.Q...mk.].y[7.W.%'....~......g........G^....<..}.'.k.c.a3.w..V/.../.j....?.P.r....$ql...rc#-.........z._..................8.r.<wu....Y......v.<..hTi...;.....o..S.L>...m.P.w../P......c.}v!~.t..........U?6.i..|_l.....7...........'z.i.m.g....lJ@[l..[..p...s}.....D..6....

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\main_close_large.png

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:PNG image data, 13 x 14, 8-bit/color RGBA, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):440
                                                                                                                                                              Entropy (8bit):7.185064395828422
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:6v/7Jmynud+EVDvBXmY5j9yEhcZxAalEbKWwz:vyGbVDvxJ5alnWwz
                                                                                                                                                              MD5:3F33BF7A71F1A94B30AD98121F2DC31F
                                                                                                                                                              SHA1:533B933BACBAE375164518AF202EB90086BEFC44
                                                                                                                                                              SHA-256:4D3581315F5AB93538BEE793BA9727FC9E8444E9B09773566C4BDF0C44618828
                                                                                                                                                              SHA-512:4E768ABACB878A5F9BE79B91E9BC77778F62AA4ACAEC4A246AB3359E86FF685250A1BA9E7765CE5174A42E5936CFAC27CB381B505F92F30EBF4B43806848899C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR.....................sBIT....|.d.....pHYs...........~.....tEXtCreation Time.10/1/14........tEXtSoftware.Adobe Fireworks CS6......IDAT(...1K.a..........+ht...".96..\....M..f..9........ n....~.KK..o..~..g{8.:...I..D%...^..6V......w<K.......z.?..dk2..p.G.U.&...?..U.].m.O....L2.o.`<,.....k....|....L...Q._.<.....?(...[...lW...O.6....Z....r.q....Nr..p2.d._.w...1....F.....@..x....x.X..T./.H..w./.yrd.......IEND.B`.

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\mcafee_pc_install_icon.png

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:PNG image data, 67 x 57, 8-bit/color RGBA, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2052
                                                                                                                                                              Entropy (8bit):7.890065571351557
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:CHjblGYXQQEZZyIOrNK6rC4lWVkOjKpgOojQ9dCe2LfmC:PYgNZKJKSC4YF+WjyOZ
                                                                                                                                                              MD5:18344204EC04F1E95E086D3BC94FA0FD
                                                                                                                                                              SHA1:87CA3ED8948774091B451F7CB2F95139E56D351B
                                                                                                                                                              SHA-256:30ADF46FD9311E5C6DFEA8A2AB2176EBAF83E7019EE341896FC3AAA5F498D2BA
                                                                                                                                                              SHA-512:13757DC62505D01E44523823F38001D28A2FB9CBA5ACBF9CB7D9BDD8D0F19583D814E5A47B2DB255E18CCC05C34D43A02C387B60D05D1E802F9AF527D3633C5E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...C...9.....ms......gAMA......a.....IDATh...l.........|u...4q....T$....IHK.u.h...lS..{.....i.6..h....@PX[.&...AH.&.($E.(.R..).......M..:..}.g.M.8.c3.'........{....}.``....q.. 0..b.=B..?.:t......1..P_f5.......).7\..e..Y.gA.......XPL...Hss. .ks..... ..aPx;|VO..{{{).`"...VAb....u.|..>_..#......2>V......9.g ....<Bss.T....LFI[[..+%.Y.....N...~X.!......h.q.J.l...A.s...p8,.|.K2..'.{.j..c.<.|m..<.....'.K....zF...nu..<...\.a#U.Q.a#`..ZF%`...6..=j{ta...ax.....\.<.H....<>.'...x......./n..g..'G.z.E.|.....(H~)2...U..O.?w...u.X{..j.v.D.M...z.9.|.a.......\v..f..0....0..1Xs..p&5.C.?....XY.~...K...p.._.+.*...KEF......5V.f....l.u...N..../o....t....b.......z.).....v............f......L.:.n+..s>.r0l.i..&.u...1.J)..sk0l.j0j0l.l....C.......*3Q#..7.......f.[..&).r.z..0..^Xs...z.-`....3..........{N.e...g...O..~[A.F...."....E.d|..?.8S.........}.|;.......>u..B.....Y Z.w.....W..:...Z+.r....+...7..._..b..........~.a..w..o........0.J...[.d...W..>...

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\mcafee_pc_install_icon2.png

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):7205
                                                                                                                                                              Entropy (8bit):7.9471260512499375
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:KS4Do1RyFyKSZ4pTSumpAO/Ap6CQU9Uw/JLO/xvifnL:F4E1RCFpWumX/Ap2UeMq/xGL
                                                                                                                                                              MD5:F2E3045621ADE164E9DA40F294BEB00C
                                                                                                                                                              SHA1:36E9D967C679FC898BED1FF6751A73BB863EAF79
                                                                                                                                                              SHA-256:D820CF499FC4A9453771A23209A6C63DDD2CE3439E8B651A98DDF0C36ED2BDA5
                                                                                                                                                              SHA-512:7E515A44BD63B33881EE86E0A911897138F2BA0A6E81925612EAF19E3EDAC5A9FDCEDE30E3AFF3E906A4BBA8AA4570E06308D75783057015C882C7E62A880928
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...`...`......w8....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..............pHYs.................tIME......'..l.....IDATx..y.\U..?......./.@@....E&..P..GF.Q.F.....#..T..........D4.AC....b. +![w..NuU/.....q.z!.ToI@..SIW.s..}.y..s.U..?g.D?`..._T.(..}.n.I.w"+_..r0}y,.....`&....P......8.,....n.I..c@.4._....]@.J..UL.....A...[K........[.-...A.....g.'.N........#.l`.p'.d..o.@@T.P..tQ.A..........t..q`5.=...B.(Q.).."..`1j..&..n....}..e..].....-...x]..p%d.(,............g....o.C......p.j ..W~tW.3.]mq ...H.Q.P..-...Q2...v..O(..`...8....?.4...A..}#K...m......|-.....w.2.m..lwL....Ys..y.;..\.Q ..p..e....B'p..........^@m.c\..[..Z!v....*a5...T#R..B8YH|.....iw...8......,f.v......i`..:T.!F.\....t"5....0..._..K ...M.`.8d.5.9.x.c.v.A...Ug...Va.d.?..M]B.U..E.E.....: . .B5.B.1."......>...w7.-....@.P.;.d.LUp.D.0..R..TE......k..K[.>o...?.~....i..}bu...6......Pj.g.U..~'..+.|.F'......y..t.p..0.6 ........E.).n`...3\-D.......^~6..

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\mcafeecerts.xml

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:XML 1.0 document, ASCII text, with very long lines (2293), with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):126293
                                                                                                                                                              Entropy (8bit):5.969613768259596
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:sY+8or+sWZ21Wzwtp31uRla7GTvfwjBobALAnr+sqDK7G3lq0lAE:dcPsjO31ui7GLjA8rPqDK7Gb
                                                                                                                                                              MD5:D0CD30BD9B02F33B222FF8A846821D4B
                                                                                                                                                              SHA1:DA85556707CB3FD59E08DF69017DF6BB82E52F62
                                                                                                                                                              SHA-256:1CC3969AEF3DC3DC2330DB0386C6C27C09A58D078689D8D97D900A2B9ABE31A0
                                                                                                                                                              SHA-512:6C1F9DE0897F02648638B26F20728C5F2E9822F8CAD232ED42ACC18F33AAE7E102C7A00E5D42B80C10E423DB937DC6AB783255342B12B0DB07B378508886C2ED
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:<?xml version="1.0" encoding="UTF-8" ?>..<Package Version="1">.. <Certificates>.. <Certificate Name="McAfee Trust:0">.. <Privilege>PRIVILEGE_IOCTL</Privilege>.. <Issuer>Microsoft Root Certificate Authority</Issuer>.. <Subject>Microsoft Code Signing PCA</Subject>.. <ValidFrom>20060125</ValidFrom>.. <ValidTo>20170125</ValidTo>.. <SerialNumber>6115082700000000000C</SerialNumber>.. <PublicKeyMD5>4A171B7E5701870357585DD1BAAD752C</PublicKeyMD5>.. <SHA1Thumbprint>FDD1314ED3268A95E198603BA8316FA63CBCD82D</SHA1Thumbprint>.. <Data>MIIGgTCCBGmgAwIBAgIKYRUIJwAAAAAADDANBgkqhkiG9w0BAQUFADBfMRMwEQYKCZImiZPyLGQBGRYDY29tMRkwFwYKCZImiZPyLGQBGRYJbWljcm9zb2Z0MS0wKwYDVQQDEyRNaWNyb3NvZnQgUm9vdCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMDYwMTI1MjMyMjMyWhcNMTcwMTI1MjMzMjMyWjB5MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSMwIQYDVQQDExpNaWNyb3Nv

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\mfw-mwb.cab

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Microsoft Cabinet archive data, many, 10317 bytes, 6 files, at 0x44 +A "\mfw-mwb.manifest" +A "\packages\mwb\mwbhandler.luc", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1503 compression
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):31757
                                                                                                                                                              Entropy (8bit):7.819683260087871
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:vS+ktRZ7B8dfc2HiPvYEAMxkErx2PsFdmAMxkEX8:vGtnmu4iJxB7FdUxz8
                                                                                                                                                              MD5:3F9C31CEBB65AFD11CCF1FF7F1562BED
                                                                                                                                                              SHA1:C89E506E4CF8C6724476C03DB9B79F0668897D67
                                                                                                                                                              SHA-256:4EB2DCBC64CB6BD801AB9065C738CDFD69878D7F8D1B4D5BFEE032E6A3D8732A
                                                                                                                                                              SHA-512:FB359833C873D827F0DD24B992CB4CCCFC7B789B1A2D6A17DFBB44020932958F1023E2DF345EEA6E0218425743025C246E802B3CF2C89A4CFFB34182754D36BC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MSCF....M(......D...........................M(...S..........m.......W..........X7{ .\mfw-mwb.manifest.....W......X7{ .\packages\mwb\mwbhandler.luc.3..........X.d .\packages\mwb\stop-video-alert-icon.png..*.." .....X7{ .\packages\mwb\wa-controller-mwb-checklist.js......J.....X7{ .\packages\mwb\wa-mwb-checklist.html......T.....X.d .\packages\mwb\wb-rocket-icon.png.W../.&ZV[......e..A..#..O...T.C.2.Z.....Q..Rv#....mkH*...w..'..}+..;...D...D...F.......$Y.u........@.f.Yp......zK......].6...l........j.......2..eI.8.X.0tW.......8.................3..m...-{..r.....L.=.). .P.Yx"/`.....x~..p?.~..X@(0y.$..$.6.,.t...>...,.+c..r......s.H..1...H..l...$N.\ej.1........@....at=...G.r....G\...p.="...ol.o.L....JB5....(:.K<(...*.0...D.n.2.......hd.Tn.@...I....1.o..fa....;....4L........& . ..Q|..?..fxK.R`..?..T$...y....K...e.)..y.M....Li....0.E..fs...S..UrN."..F...NG..w6o.f.A".F..5Un.....A,>^.$..........O....a...._J.}.r..^.....~x.T.....\..............hy.t?s.....P......_...7,@2..

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\mfw-nps.cab

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Microsoft Cabinet archive data, many, 12600 bytes, 6 files, at 0x44 +A "\mfw-nps.manifest" +A "\packages\nps\clipboard.png", flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1503 compression
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):34040
                                                                                                                                                              Entropy (8bit):7.8383623419968655
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:ZK68A57K834uN559LfX02HiPvYhAMxkE002PsY4XAMxkEgDUR:A6heWJN55G4i8xj7pXxV
                                                                                                                                                              MD5:55996C3B4B46711EF4CE6085B7E36015
                                                                                                                                                              SHA1:DC63012F9C103EF2548FFBAE7FC86A02D4E9286E
                                                                                                                                                              SHA-256:BE220819208F14AC07FAAF8400B2961ED44A34F50AEDF4399305BC48BF59EF08
                                                                                                                                                              SHA-512:D75C48452AB92BEE0715402FDCDC95E15769F5526E6917E3EE11B707193525E17DBEC7D95DA47182461449CE6956D49084179EA8F3B1A5713CF36C8C19B9B528
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MSCF....81......D...........................81...S..........Z.......P..........X7{ .\mfw-nps.manifest.k...P......X.d .\packages\nps\clipboard.png.-..........X.d .\packages\nps\info-16.png............X7{ .\packages\nps\npshandler.luc..j..{/.....X7{ .\packages\nps\wa-controller-nps-checklist.js............X7{ .\packages\nps\wa-nps-checklist.html....4.*..[.....@.........?...^B.$x.Bli...+o.{3../^.+.../..P\^R.^..@...\.........B..m........A%.].w.\f..#..bI......9.^................O.._P..[.u)..;.F...6V&...!.2....d.e..S.LP..1.Q....8..Vw.U#P..m..l....87......h..t...]...!..V..{./..9......}...6vwf..._..f...a...RaWT:3..?a.C.5.6A+><...#.......?. ....._..~.....`....^c.3GLW\.....S?..7.Cg{.......p+.p.~.~.....o. ...w...?......?.....q...........K._.C..V.ig}.5.....0....N.3...&(.c.$...'...a..V..^.a..w....s~`~.....ln_...E.........S..../...}2?lh.....2.4......_.G.t...?z}C.6.f..1o........R.,..Kk....m......3.......:..e./...{..A.@=......-..1"".....CQ ........../(..&!..CC.D..B...

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\mfw-webadvisor.cab

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Microsoft Cabinet archive data, many, 945875 bytes, 209 files, at 0x44 +A "\mfw-webadvisor.manifest" +A "\packages\auxiliary\reset_handler.luc", flags 0x4, number 1, extra bytes 20 in head, 50 datablocks, 0x1503 compression
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):967315
                                                                                                                                                              Entropy (8bit):7.997535620824006
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:24576:+2oI08AoJRlJiyE5A+PsG6dgMpq93s5WL:+2YlSR7IJPzMpq93xL
                                                                                                                                                              MD5:9DA97051F520ECE2F9ADE5CB5FED480F
                                                                                                                                                              SHA1:46D1E9D5B39CC67DC5790B8BA6723E5D3A41867B
                                                                                                                                                              SHA-256:4C8626B9F50F8BFBA2C4B8BFD129B1DAD7188129151B198942C2298F1F818166
                                                                                                                                                              SHA-512:DE32F4A57BD5713514E2D29019B8DB90255939469E19F567F7B9D4A229B2CB7F07F109D77241CA61E40E6F31BFABE2F8DD3C3F302107595A63CB9AA57E97A8DD
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:MSCF.....n......D............................n...S...........4..2..............X6{ .\mfw-webadvisor.manifest............X6{ .\packages\auxiliary\reset_handler.luc............X.d .\packages\builtin\balloon-arrow-right.png............X.d .\packages\builtin\balloon-arrow.png..5.........X.d .\packages\builtin\card_bg_image.png......N.....X.d .\packages\builtin\celebration_white_bg_color.gif.8...iJ.....X.d .\packages\builtin\close_icon.png.T....K.....X.d .\packages\builtin\dialog-balloon-logo.png..I...Q.....X.d .\packages\builtin\enable_ext_guide_ss.png..R.........X.d .\packages\builtin\enable_ext_guide_wa.png.d4.........X.d .\packages\builtin\enable_sideloaded_ext_guide.png..8.. #.....X.d .\packages\builtin\keep_changes_guide.png.W....[.....X.d .\packages\builtin\logomark_white.png.....<].....X.d .\packages\builtin\mcafee-logo-1.png.....Sc.....X.d .\packages\builtin\mcafee-logo-2024.png.EP...h.....X.d .\packages\builtin\open_sideloaded_ext_alert_guide.png.....2......X.d .\packages\builtin\

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\mfw.cab

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Microsoft Cabinet archive data, many, 296467 bytes, 54 files, at 0x44 +A "\mfw.manifest" +A "\core\class.luc", flags 0x4, number 1, extra bytes 20 in head, 33 datablocks, 0x1503 compression
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):317907
                                                                                                                                                              Entropy (8bit):7.995337822146351
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:6144:pGnL5pf48bM70KocnX7ZuOD9bOFkMchEtl4G1rLGni69TGo+/vnwQ4qg+:pGnLvf484YKoA7ZuODtOFHtlv1vGiBMe
                                                                                                                                                              MD5:5D1CA41EDDD5514E617CA66E3D42EA3A
                                                                                                                                                              SHA1:A0AAD3FE1716DEE32B0E7C4CA6DA1DB8DA9187E5
                                                                                                                                                              SHA-256:0C8D91673C6F4D9DF06530B6D813DF60FF0E430CBB40EDE4D1D7B0381A15858A
                                                                                                                                                              SHA-512:FF645450CA81D584AD691F2FA5EC1FCCA35B59228AC26EA444944AABE2B9153F3D1C0FAD60DC508967E5665783C050410E130DE3180FEA1D0F22BE6AF9DAEF8A
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:MSCF............D...........6....................S..........3...!..............X6{ .\mfw.manifest............X6{ .\core\class.luc..'..H......X6{ .\core\dkjson.luc.....B2.....X6{ .\core\handlers.luc.....M;.....X6{ .\core\init.luc.2....D.....X6{ .\core\json.luc.....%G.....X6{ .\core\logger.luc......I.....X6{ .\core\postinit.luc......M.....X6{ .\core\priorityqueue.luc......R.....X6{ .\core\triggeracceptor.luc......T.....X6{ .\core\uiarbitratorhelper.luc.....Oc.....X6{ .\core\uihandler.luc.u....h.....X6{ .\core\uithreadexithandler.luc.Kw...l.....X6{ .\core\win32helper.luc............X6{ .\core\utils\browserutils.luc.r..........X6{ .\core\utils\common_utils.luc.c..........X6{ .\core\utils\packageutils.luc.....[......X6{ .\core\utils\settingsdb.luc.}...T......X6{ .\core\utils\stringutils.luc............X6{ .\core\utils\telemetry.luc.^..........X.d .\packages\builtin\green_check.png..>.........X.d .\packages\builtin\icn_mshield.png......].....X.d .\packages\builtin\installer_background.png..l

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\resource.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):38328
                                                                                                                                                              Entropy (8bit):6.329891461703883
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:TBr3M65yVi2HiPvYkAMxkEoi2PsMAMxkE5rm:Tt3xsE4ijxP7KxZm
                                                                                                                                                              MD5:4996B7669CCFA39972FA4EF6B198B1B0
                                                                                                                                                              SHA1:F3E0F536C1EEDDF04CCA1CD85AF70637845AD896
                                                                                                                                                              SHA-256:8BB76C4CE1E07CB745713D9F6258F337BF08D84AD5EC5F7F9AF26C1680EC63BD
                                                                                                                                                              SHA-512:B921D892B2076CBA6DC78770532626522EC461D3D9E8631B4248A8DA2437D8473E412E46AB8A46CB8AB0DCA5770E217EDAF9C713741673C38C4082F45C1E75BE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Q=.0S..0S..0S..O...0S..OQ..0S.Rich.0S.........PE..L...@..f...........!...$.....>...............................................`............@.......................................... ..\:...........@...U..............p............................................................................rdata..x...........................@..@.rsrc...\:... ...<..................@..@............@..f........o...............@..f........................@..f........l...............@..f............................................RSDS..I....C.....$.x....c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\Win32\Release\Resource.pdb......................GCTL....p....rdata..p........rdata$voltmd............rdata$zzzdbg.... ..`....rsrc$01....`!.......rsrc$02....................................................................................................................

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\resourcedll.cab

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Microsoft Cabinet archive data, many, 30216 bytes, 3 files, at 0x44 +A "\resource.dll" +A "\resourcedll.manifest", flags 0x4, number 1, extra bytes 20 in head, 5 datablocks, 0x1503 compression
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):51656
                                                                                                                                                              Entropy (8bit):7.922145909670809
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:X1gqXZ6Axu6iVH06RbxPp6Ca5jfXxE4io0xl7+1xF:XmqXZ6Ax6VH06RNc15jJE4AG
                                                                                                                                                              MD5:B7C261AF55CA38A89235CBB58D94158C
                                                                                                                                                              SHA1:28473E65868C2094A6E43352E9614A427E620C34
                                                                                                                                                              SHA-256:F06FCEB7646DB8A2630F9D9310A93726E82D8E8474E07795D4D6AA2C6527D6FD
                                                                                                                                                              SHA-512:17FE09A6DE57D9BC709B72CBE61E69F87A60929CE16DCB6793EC60D029066939FE1339D462FD207350C55B85BBE69E2F03CA03C7EE2C280056124C47B17785C3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MSCF.....v......D............................v...S.............................X.{ .\resource.dll............X4{ .\resourcedll.manifest.4...p......X.d .\webadvisor.ico......6..[.... ._q..@.....@..;>k.TZ...h......vX......,..$...T..PJ .$.J..(.R.@F........7~..W.$........m7.HjC]..9....9J.B..5.w..7...jp..x=.]....w...}...J.. .d!...........B..4RWE6p..........s.$........L..U.JQ@...".....5.i....>..I.B<..d.@./.xB.l..'...."..,..I3../..........K.vp-A......7.j.t.U.....$D.#._j4...9........J...x.....Gd...!......B. ......v....O.:..F.........c_.>...m.>.....N...f..........t%.O..G.1....a...tTds....0R..=.U.......g ..(@W..,.E..6%.....,.......).<..1.._./=r/ON2....7...............D/313....y:..J.W\...l...]...O|..2..kS.*D...cy..y.v..stH....x.....\.N.{.`..7.;.62.D..m.<......../... Cz......Y.w./...{...`\.{N.+.|......b.E...I.=.!.PX..]..w.....r.;..d..;.@..(.Rl.@J...1E.....(.S!.bP...F.%(,V.Q.8EQ......T..+.....:.......L...`P..0.S)<Q.P..P:.._..F. .Ka.M..Q.u.B.......6..,i.b...

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\servicehost.cab

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Microsoft Cabinet archive data, many, 303323 bytes, 2 files, at 0x44 +A "\servicehost.exe" +A "\servicehost.manifest", flags 0x4, number 1, extra bytes 20 in head, 27 datablocks, 0x1503 compression
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):324763
                                                                                                                                                              Entropy (8bit):7.997130631830364
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:6144:dlm3FJtemWa+hpe6N4OdyMROOisoTrlhWaY3fdJaEG84s95pC4z/:DuMmWa+hpPN4CRPibdCfd4EMs95pd7
                                                                                                                                                              MD5:EA061153AF4C573F4A67B066EA1C1E86
                                                                                                                                                              SHA1:32576F2322BEA6AEF026F80181325443D87B7AA9
                                                                                                                                                              SHA-256:2A6266E11887FCC5C32E388489A208A9BB3BA4DD824D3E2B53FB8AD2045A9EAA
                                                                                                                                                              SHA-512:1F6992312D0C08F5053A6F79F83BB3E131DE4B2E3A5426592CFFB8927E1AB7DFBCA95AE90A1D416E129DBBE52BD10BE1B438CE0C1AB24727B80A4F099F5C0C9D
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:MSCF...........D...............................S..................`k.........X.{ .\servicehost.exe.....`k.....X.{ .\servicehost.manifest.........[.... .....PC.$"....>.EF.IJ.CC3[.... ;N..}' Bf5.8....\A..&;.....e831A...4f44B.....Nm..m3Ph....Y......~.....f..q.~...z1.#....K.(.D.$.)..4....l:x...}pZ&X.(9.a.]..C(.H...f.K9.#.2.F.t......@.....U..Ts....'.B.....g...g.N.....V...l&..Y........v..l.....l.?b.Qq..1...9.Q....Xy[...^.9*g...........6on......`}\..z......q.._o.....'.......e7co..faY....-...?/P..b..?xqx.)..-'....6..n.U$..w.k.o...!..jKw...G....t.{..x..).-.v.o.m........v...i]{5.{........u......$..p.@...@~k..o.Q.......|=..X..y.7....y1.j..~j.-./...m...^.yC...!k.xg..w...HI.......|.,o.s.R...Z-.{.,.^6.1..Z.....m...).f....80.\..N..oj....!]mw........E...{....._.......}..C.W0.m.....j*..............4....M{.7%sc~.z..n/...?...Zr.,....D.......x....>f2..P.W6,.}..Y.....s.....o.(.w...........)..?...1.VN..QrB....Y.K....;.>^...z.....f....].e.q.........[%......^

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\settingmanager.cab

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Microsoft Cabinet archive data, many, 785295 bytes, 2 files, at 0x44 +A "\settingmanager.dll" +A "\settingmanager.manifest", flags 0x4, number 1, extra bytes 20 in head, 63 datablocks, 0x1503 compression
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):806735
                                                                                                                                                              Entropy (8bit):7.9994177714716015
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:24576:RzpqpcuWaUH/NGXStV0Kl0fzEOYipi8ouPOIA4:NpqpcvGSt90fyiphOIA4
                                                                                                                                                              MD5:5588971CF645D4C6ABE6A03CC5C0666F
                                                                                                                                                              SHA1:F6B8BC56A072C59F7C3570E3D5CF0C20585AEFC5
                                                                                                                                                              SHA-256:D8FE746EBE0D38F02DE29199D61231566D8D04BB359BE7CE3A90587509CFAA16
                                                                                                                                                              SHA-512:F0D0C633BA6B5124CA018E16CE4449CA381FC20B7E5424C4E51AB1A28FE981371F25F618511968ADF979CAE5001C715C407146BD4EB5594FAEE6A96CA60EE1FA
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:MSCF............D................................S..............?...H..........X+{ .\settingmanager.dll.....H......X0{ .\settingmanager.manifest..h.....[.... .....GR.C"....+}...]..tZ..F`..D.e)YvIIV.K_d........"&....%.w...C.]. .^.oC...o..~.....o..O.....@.f..f.......s.....<-y..~..?..@#R"$...Dw.L.....$..6[.+24.PF...I,.\ )W.......(..2t........#."..........D.ES`V...._...Q.8.*..^JP..W7.).....M.~.dB7...XV......0_....:'v...Y.....M'?..xM...q.|.5.O....G~..k.>.q.+..~.'..zC.....e....3.^......v.......c.}.....k.G`?%.i`.\./..v..o5.O.n......d..d..xy..{...,.~<...K..a...l.o.t.7..%...j...O..6...w.j....w.O.i.....+u.R.<.6{....4.2.>.5....S..m{..#..K........~e..7._./`....#.......7=3q..x.7.OO^..{s......9.r'...o...s..n...e[;2~.?.<......G.g.....6......S......S.g...{3.+.K....g...y.o.j:q{....&..O.....Y.k.?....>......;./-..0...#.:............gJys...(.l..5..f\.7n.....?.w....h....R..8...O....?....{.......l..Y..s..C.?.W.[u._Wr=..wb.......{.g.n.....U>~.o....z.....N...

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\taskmanager.cab

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Microsoft Cabinet archive data, many, 1284387 bytes, 2 files, at 0x44 +A "\taskmanager.dll" +A "\taskmanager.manifest", flags 0x4, number 1, extra bytes 20 in head, 119 datablocks, 0x1503 compression
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1305827
                                                                                                                                                              Entropy (8bit):7.999428586017531
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:24576:ootbphi/FnT46V3i+9tVSwY7B9UikYQcW+8dC1IcgodN:oOoRT46VT9m7L56cW+L6todN
                                                                                                                                                              MD5:76BE2780A2AA4DE78FD7F97AB8179393
                                                                                                                                                              SHA1:14CDB621500A625F6C914A316381AF999DA72B46
                                                                                                                                                              SHA-256:ECE371E37D346CF6CB00970AA281B1891791C34DCF50769F13A45851454A9B26
                                                                                                                                                              SHA-512:241AC74D2A0E3BF5CD4184AD9A29F8158EA47565F84D5F6ACF99D30463A35A6A0798A11094EA6176F5259E9951E466A1FCB2418C5D712F0D7C5AD2EE3EA4DBD1
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:MSCF....#.......D...........................#....S..............w....%;........X.{ .\taskmanager.dll.@....%;....X1{ .\taskmanager.manifest........[...= ......B.0".....L[Y.....r.t[....Q.d\....'.%2A.e..6L$.......%J.,.I.%.I..2...I..RA........".+..3.+..=......f.....&@%..S..RB.4an.$.].bRG.y..S..m-UVif$..(:*.N..Fb.a;F...\.8&..t....@.,....:#.D....N.@.........B3.CUVFEP..G{|/...X5.:*.(.n.&,.a.<.`.,._c.0..^....q.l.......W..=....k..vY...vf..u.4{..n..G.5.3..<.!....)...DW.....'R..G.).......{.6..../..#4>.G....+.o..X......#t.;o;.g...6.m..>....]....}{.;.Gg..v.z./?m..s.:vn.b....L.?v....or.Ex.1....RB..?'}k..1i........c.n.m[....>.<.._.....?'...........|.w.}C...[j......./....h..........8...........Okw...3.}..[.F#nr....M..g|...1.]mA^;....U0.....g...+6.?....%....9.g..!......n......{....w......b..?....._.*...\....}...[......W...7<o...L..?......Ws..RV>.k}.l...s}.G....._..7...G...G....s~...n..6#!.|.!..|[...<...9Y~.h?.....y.o._~.t...s...k.8w....g.d.7<SW.I..~.9...........s.|o....

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\telemetry.cab

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Microsoft Cabinet archive data, many, 70038 bytes, 122 files, at 0x44 +A "\telemetry.manifest" +A "\dimensions\dimensionconfig.luc", flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1503 compression
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):91478
                                                                                                                                                              Entropy (8bit):7.924241023277605
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:knDKUhC/hzymxTd44L0ZBK6T8X/iOwkf8Th6aYUnT0UKXTp24iixX7cx7:knDbU/h7r44L0ZX4/xQYUnIUup249e
                                                                                                                                                              MD5:957DA14451474D2A91BCF01D4C71802C
                                                                                                                                                              SHA1:CF07C98A52DA03A8A2A4DB0E08A9192AB46D3D7B
                                                                                                                                                              SHA-256:6F318A02F2AFC119903DCA2394FA54A748994C6051D8CDE5D7BD3F412A13C8A3
                                                                                                                                                              SHA-512:902B0A6C5DD83CB4E11A78BF47EE4BF12E93392768C60889CB837CEC91CA69C74D21E716732C43D0BF86CD728989C4DD8CE5B8AA21F6CEEE09C3999D87A5B9DC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MSCF............D...........z....................S..................@..........X={ .\telemetry.manifest.ym..@......X$w .\dimensions\dimensionconfig.luc......x.....X.w .\dimensions\dimensionhandler.luc......z.....X.w .\dimensions\dimensionprocessor.luc............X={ .\dimensions\version.luc............X.w .\events\eventformatter.luc............X.w .\events\eventhandler.luc..... ......X.w .\events\eventtransmitter.luc....."......X.w .\events\handleonnavigate.luc............X.w .\events\sendonping.luc..{..8......X%w .\events\telemetryconfig.luc............X.w .\events\telemetryhandler.luc............X={ .\events\version.luc............X={ .\serializers\download_scan_ui.js......!.....X={ .\serializers\edgeonboarding.js......%.....X$w .\serializers\edgeonboarding.luc.<....(.....X={ .\serializers\edgesecuresearchonboarding.js......,.....X$w .\serializers\edgesecuresearchonboarding.luc.,..../.....X={ .\serializers\extensioninstallationtoast.js.]....3.....X={ .\serializers\fw_av_warning.js...

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\uihost.cab

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Microsoft Cabinet archive data, many, 298311 bytes, 2 files, at 0x44 +A "\uihost.exe" +A "\uihost.manifest", flags 0x4, number 1, extra bytes 20 in head, 27 datablocks, 0x1503 compression
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):319751
                                                                                                                                                              Entropy (8bit):7.996949768193193
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:6144:BRjsaAXYSbeyQ+Ajo2LoWO3YXe1QDrNmpF2fwADn/NTZY/4SZ:bsFey6joPEXe1QD5mCbTrq
                                                                                                                                                              MD5:678772D8852F9828800A2DAC57A3E920
                                                                                                                                                              SHA1:D7DFDD0607ED955CD5BC85CC543E2D9837CE3053
                                                                                                                                                              SHA-256:87734056942C5D514D3CDC1B85687B7C48F59D3E4C8F66819DB3BDF945D9ADAC
                                                                                                                                                              SHA-512:63F95D3BB47417C7DAA1B4C665376F4A056B0FDA3EC351A158BFEF9401BEA29F5C262CC0CBB292B097BE77862A0B4A64AE21193A665011A76273C62E828DA854
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:MSCF....G.......D...........................G....S..................@..........X.{ .\uihost.exe.-...@......X4{ .\uihost.manifest..O}. ..[.... h}...PC.%"....h....$../.N..$.............3...4q.0G d.'4BN{....g.O..i;.!.......;....;.IH...........g...s..._.s.N..lO.(.E...DU.!.dt1......L.fzLE.....F*l...P.0...)3...PA.Uo..D..N...........PTU4TP...z.sX.PP..gB...'..%........k..H.=.........~..zw.._...3L\6..^s...|.-.^ny.o..r........7.8m<../.K....gg.w/Sd.....K;?....^q...X......1?}...6..x..>..w......&.....U9S...g,{.l...#v.tI.......j/...G..~q....'~.p..{.........}.............r:...v..x.._.zsS...9......z......n...a......au.......~...."a.EA...G~..f&.>.{.~...o. ....~.d.i.[...........@.0...x:......{...u.?......\w..c..k{.1..._..._J....../}b..=...E./;..?.;...|.._.|Y..i.\..wM.=0..[_k..7.|...M.._....w.^.7....[....Ol.....`....../..u}....A.....O.........~..wQ..+...x.Kt._.....EM8..._.:.~...7oz...hg.|......h...^.s2....Y.7*?#.S..6..!C.{.x]x%...W....w..n.x...z..W...o..

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\uimanager.cab

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Microsoft Cabinet archive data, many, 1774219 bytes, 2 files, at 0x44 +A "\uimanager.dll" +A "\uimanager.manifest", flags 0x4, number 1, extra bytes 20 in head, 166 datablocks, 0x1503 compression
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1795659
                                                                                                                                                              Entropy (8bit):7.999515311575382
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:24576:4MMv3hinxjtmPUxyuUEg2OI6Tx0/0uuA2t/G1cS6R+IyU/N/rV76gXlm1uuCx:VM/hExVgXq530/NS6RPVDJ6EcYvx
                                                                                                                                                              MD5:EE2BBF4843C71F8334917F81099455D7
                                                                                                                                                              SHA1:9A9F2D8670187030979D10D58BD2391AAA263804
                                                                                                                                                              SHA-256:8D558F307E75D9CAE80CB708DE51B7392C0644B290886B255F5ABF2CFB9EB51D
                                                                                                                                                              SHA-512:16CE04880164E11DE7F7AF5D9596CC2C8ACE8E23FEC8216CE96B8B4ED72D50B5651874CC65EE1270DC7E2537B709064ECED8EFE207E043F94B00D62B924265B7
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:MSCF............D................................S....................R........X.{ .\uimanager.dll.).....R....X4{ .\uimanager.manifest...2.l<..[...V .....@..0....._...=?.k.\r<......\<.v..x.7...V{....{[.go...^../..Gr...]4#3DU5wVg..}..}...|...k4..I.j......-...ZG^.m....U.....=.$.vo&.."..Vm..(.....X..6,mOl..1o...X...x.b-.E.T.~A.....K..4..n. ........k....|.`hhh.........[Sm..J..S..S....l.......g.'.&<.......u3.Q.~.;s..f..C.0....Rj..C}..$~.m..8B7]....7......}pn.....p.....6o....p......5:..nE.{.?.M....Y.......F}.Onh..r...H.z...h...^Z.}./.o.H;l.{......Gm..k...S...t....?_..=..t.[...........<.K..5._o{..4..UjS}...s.....2t.......Z.....;........Sz.....Oi...p.=w....7=u.G.-...O3.........'.......K....../.}<.+..yc.{.W...>....V.[./..f4...~...<..........Q.].T..A3z.m.w....c.....{6.G....'......w.{w......\.....a..u..y3....=...F...b.........{./..p.. .}..~......<.............hz..G\.E.g..4].n......o.{MG..1Mj.x.....u......n~.w+..:..;..T2B......e.....jmu..;...

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\uninstaller.cab

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Microsoft Cabinet archive data, many, 973372 bytes, 5 files, at 0x44 +A "\uninstaller.exe" +A "\uninstaller.manifest", flags 0x4, number 1, extra bytes 20 in head, 86 datablocks, 0x1503 compression
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):994812
                                                                                                                                                              Entropy (8bit):7.999514166436144
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:24576:O/lY7t8obuwxtZ+e9MUhUbLSrhSfgPhfDaqrEph2:ONY77uwXZe8hNhbYh2
                                                                                                                                                              MD5:B835D6BB95A094932181432044B4FEF1
                                                                                                                                                              SHA1:E8A7FCC4A4785A0F1E29A61FEF3A053DD04DC276
                                                                                                                                                              SHA-256:16A95AD59565E3CBEFEA1EC0EB95A50D06064D902DD61D6516C17A3B52F77978
                                                                                                                                                              SHA-512:ACD109DCB3B8B1D96F4A97A55C1396A50DD7506350CC83B05635F2368AE01FE1BB993160538B569E74E3554682B27E991E755FDAEF7C02E9118C4DD10952E73C
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:MSCF....<.......D...........................<....S..............V...`S*........X.{ .\uninstaller.exe.u...`S*....X8{ .\uninstaller.manifest..'...e*....X8{ .\wa-ui-uninstall.js.......*....X8{ .\wa-uninstall.css......*....X8{ .\wa-uninstall.html......*..[.... ....@S.$".....^YY.;.V.................A..BA.N.X.... ..X..j.FP5R.8.(.+.....1.8................/..~.~.. .......EE....5.C..f'S..h..I^..m..lkkeqdb.a..l,.A...l.AMq.l..Mntca.Di.PP.. ..0>.].. t..A......35E4.V.D...R}.Kn..N..8.E&.8...`...\...h.......E.D%+./.9_P.%w..fp....n..r.......m..........*.V...On5W.~Wm.qJn..c..u..^..Q..O.w......\.....]+a..?.@..n..N.......k.8.?..Wy/.*...T.4....K...{.._.r=S...._}.\.U=*.{v.I..gz.Q[....I.BE...w.y....N.T....2H....0.dZ...:...G....M8...{L..m.9S.}+...M..OC.t.2..y..cY.n.T....eY$..=c.....6\G.k.[e...............s.:.q.8...J...+..wk..s......t~...MC*.....F.7.%.>Ww5.k..o..w.y..F^I...d..7.~.=....-K[.X.[.-u......o.w.v....%.:{.7........awnU..........RZ...r.0.....*..N.J.V..m.k.

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\updater.cab

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Microsoft Cabinet archive data, many, 952845 bytes, 2 files, at 0x44 +A "\updater.exe" +A "\updater.manifest", flags 0x4, number 1, extra bytes 20 in head, 83 datablocks, 0x1503 compression
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):974285
                                                                                                                                                              Entropy (8bit):7.999413642040658
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:24576:Dgw3s+4+NtzE5f9qhSHhUEHenj6Mu/xdjVKyeXcrWSFsB:cw8LmtI5lqhChUEHeOV/xd5KyeX0WQsB
                                                                                                                                                              MD5:193DA0988D510382986BE94CC3388640
                                                                                                                                                              SHA1:F81F15F82FA88191F59CC3E304B041403FE8A2BB
                                                                                                                                                              SHA-256:4A270E193036BF94EFE9077C6CE3BA3D5374DD7791EEF720CD719A37510DF47F
                                                                                                                                                              SHA-512:0BE837C1CAD55C0D445F942A1EB0D73A77D69359BB0E8C1A86844315737DC0F0954F156843F5FFA73E09D7FB6D7D7878CACC53D4EB769EEE91B1D24827B7BC06
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:MSCF............D................................S..............S...pw)........X.{ .\updater.exe.....pw)....X7{ .\updater.manifest..X...)..[.... .....@T.5..........Z...N..T...k.~i.v.h#.4..bc.W.u~.we.kO.4W.0.......b...lm.R1g........X..9....,.{.....s3..V...+M(.K.....3.8PP..)@. ....3Y.B%..2+6.X.U..l-".q.X+.Vt.....I..d.,.,.*.s......L.U.AA9.{.w.;.......r$AS.)x..*..Qf2O&...TcmZXLX..%B...`..>.e.,.`...A......J'..j.Y....{....|pe.....U............W.v..v........|3.R...5..+.oE.mt.....D.....3~../.0..}.......YgU.....K...v.....)..,.B....^....;..G..51._X"../..~....<.O.+..^|S.%h.P....Y..;lS.,.<6..o...E........b-........+.|GT....a.6{..j......Fl..o.....z....2|..bU[....R.U.L..)m......,.9,~....s...._.w|%...Y..K,..<.%..................;.....o.n,."<..;.Xx.,..}.P6..W...lR.L..?y..n....>y.....w..q....].ofcKQ.eR.?...z_..K.v..:.{..x.`.W..9)..w.[i..n...[?.=.1'...W..._..p.^.dC..>.h...............a.v..~\.....vN}...l\.w....z.'5.g..&...2..t&%e....3cv...].2_.G.n..`"..6..

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\wa-common.css

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:ASCII text, with very long lines (33246), with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):34082
                                                                                                                                                              Entropy (8bit):6.048810099348607
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:E9DDI1HkcKGBrgXjhvgVfk4rcB7uGzQtn4rZW:E9DDI6thXjez1jtn9
                                                                                                                                                              MD5:BED2FF23927C34F86C480203AA7F87A0
                                                                                                                                                              SHA1:90B1B32D7A9CEECCD555D674582CB8AEE64E8909
                                                                                                                                                              SHA-256:9D7AC9A5AE897E993C0B6BAD468F56BF3B6CEFCFEAAD6FD2307CF8370945A2C2
                                                                                                                                                              SHA-512:6538FEDBC2DCE5EAF944CBD18F93783CDBFDC2920726A3509D0686BD062793B422AE6C6F67DFB0C344AC3E084F8B1F10425FA4636D1BA0FBD9E2ACE86EA6AE83
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:/* Open Sans Regular */....@font-face {.. font-family: 'Open Sans';.. src: url(data:application/font-woff;charset=utf-8;base64,d09GRgABAAAAAGEsABMAAAAAsTAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAABGRlRNAAABqAAAABwAAAAcbEIkOkdERUYAAAHEAAAAHQAAAB4AJwDwR1BPUwAAAeQAAASiAAAJmCwaFlhHU1VCAAAGiAAAAIEAAACooF6Ikk9TLzIAAAcMAAAAXgAAAGCg5ZlGY21hcAAAB2wAAAGGAAAB2s9AWKBjdnQgAAAI9AAAAEYAAABGE1sNN2ZwZ20AAAk8AAABsQAAAmVTtC+nZ2FzcAAACvAAAAAIAAAACAAAABBnbHlmAAAK+AAATOAAAJGkMGdKhmhlYWQAAFfYAAAAMgAAADYJip5GaGhlYQAAWAwAAAAfAAAAJA9zBj9obXR4AABYLAAAAjcAAAOm2kNYqmxvY2EAAFpkAAABzAAAAdZ4GFVubWF4cAAAXDAAAAAgAAAAIAIHAZduYW1lAABcUAAAAgcAAASAUcWdxHBvc3QAAF5YAAAB7gAAAt15xIzucHJlcAAAYEgAAADaAAABfLpWDR93ZWJmAABhJAAAAAYAAAAG7JdVfgAAAAEAAAAA0WhVmAAAAADJNTGLAAAAANGknRZ42mNgZGBg4AFiMSBmYmAEwpdAzALmMQAADaEBGAAAAHjarZZLbFRVGMf/M51hxoKWqtH4CBoyNrUGjQ1J27GwatpaDZZpi4MOig/iAkJCY0hMExaFgbgwIQYrOTxqCkyh0FmQUpryMkxXLNzhaW3jyuVJV8QFIY6/c9sp4EjVxHz55dw597vf43/OPXMVklSpbn2qSEvru916/rOvenep5oveHTtVv+uTL3droyL4qFiU9/0316GdO3p3K+6vAiIKB2NcoXh

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\wa-core.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):26016
                                                                                                                                                              Entropy (8bit):4.7732775716702065
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:J+6T4vNmgN8k0+yycVCI6z0jG7RMDX4WUMRmvm/X:lDIyv
                                                                                                                                                              MD5:8331CE79D4948219E9384343508B199B
                                                                                                                                                              SHA1:7DEF4CD5BC5BF06298382BA88F6FC3ACD0D9AAA4
                                                                                                                                                              SHA-256:47394ADAD8A5E44AF40B59276A4961FD433D25F9D6B271B1C22088C79980B73F
                                                                                                                                                              SHA-512:F61881076A94C22C7DEF7A08D0823CE2CD4DE29BFB35BC17A38ECD10A64E1C6E3135AC54AB984C27C8807A30F24B09866DB87D7FE78E3F864F3FF83409ECB1A7
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:/* Core */..(function (wa) {.. var core = wa.Core = wa.Core || {},.. _settings = wa.Utils.Settings,.. _external = wa.Utils.External;.... //Component.. core.Component = function (name, status, key) {.. this.name = name;.. this.status = status;.. this.key = key;.... this.isIgnored = function (key) {.. var isIgnored = false;.. var startIgnore = this.settings.get("startIgnoreDate" + (key || this.key));.. var ignoreDuration = parseInt(this.settings.get("ignoreDuration"));.... if (startIgnore && ignoreDuration) {.. var today = this.settings.getToday();.. var startIgnoreDate = startIgnore.parseBasicDate();.. isIgnored = today >= startIgnoreDate && today <= startIgnoreDate.addDays(ignoreDuration);.. }.... return isIgnored;.. };.... this.isInFixGracePeriod = function (key) {.. var inGracePeriod = false;..

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\wa-install.css

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):5549
                                                                                                                                                              Entropy (8bit):4.066110247641768
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:Uji+oLbHInScwC0oljdaLDb2nD6nu7aabv5k/yigIAMvda0hS/iS:rbonScwC0olMLDb2nD6nupbv5TbIAMc5
                                                                                                                                                              MD5:F537A07AE7D570F52EE50643365B1FC9
                                                                                                                                                              SHA1:F3EB5BF057F2F981123FEBFCC568741E4E0F8FFB
                                                                                                                                                              SHA-256:2518B71F18A08AF85F79A3947C975A098346346750F0136891279B803F369529
                                                                                                                                                              SHA-512:1DCA227E358932ADEE77011F3E0A949E20A402FE99AA71B204A2E1936EF9C159D8DDB39F1DD36E2A974369232CA59D703334833DAE72F2DEEF12C8EC48553F0E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:body {.. background-color: #ffffff;.. overflow: hidden;.. margin: 0px;.. padding: 0px;..}....img {.. -ms-interpolation-mode: bicubic;..}....#wa-installer {.. width: 455px;.. height: 378px;.. border: solid 1px #BBC7E7;..}.... #wa-installer .header {.. height: 50px;.. display: table;.. width: 100%;.. background-color: #F5F6FA;.. border-bottom: solid 1px #BBC7E7;.. }.... #wa-installer .header > div {.. display: table-cell;.. }.... #wa-installer .header .title {.. padding-left: 15px;.. vertical-align: middle;.. }.... #wa-installer .header .close .button img {.. float: right;.. position: relative;.. vertical-align: top;.. padding: 4px;.. cursor: pointer;.. }.... #wa-installer .header .close .button {.. float: right;.. position: relative;.. top: 2px;..

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\wa-install.html

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1222
                                                                                                                                                              Entropy (8bit):5.1965250702781125
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:csYR7A2NVMz71Mz7FMzrVMzPVMz6LVMCo7jhQyWaVi:3C7A2meCeiCoHhQyWii
                                                                                                                                                              MD5:7B6102C0AC1ACA3B2CE9C1B922068DB2
                                                                                                                                                              SHA1:A3C618786A418F543BD7975BDE041923D157BE86
                                                                                                                                                              SHA-256:166564BC3717B0CFCF87559521BD15CCCB5A77ACC275A771613C3B75EECB9062
                                                                                                                                                              SHA-512:5CFDA17ACDDF91F51A95E18B487AF785E2DDFD85A9CD509EED1BE057C9BFCEA592DE347BC3D274D3D945C8E79DCD06BA7FE7BA7276FF2165D38F7F1149C7398D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.<html>..<head>.. <title>WebAdvisor</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=8" />.. <link type="text/css" rel="stylesheet" href="wacore:wa-common.css" />.. <link type="text/css" rel="stylesheet" href="wacore:wa-install.css" />.. <script type="text/javascript" src="wacore:jquery-1.9.0.min.js"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-install-#loc#.js" charset="utf-8"></script>.. <script type="text/javascript" src="wacore:jslang\\wa-res-shared-#loc#.js" charset="utf-8"></script>.. <script type="text/javascript" src="wacore:wa-utils.js"></script>.. <script type="text/javascript" src="wacore:wa-core.js"></script>.. <script type="text/javascript" src="wacore:wa-ui-install.js"></script>..</head>..<body onselectstart="return false">.. <div id="wa-installer">.. <div class="header">.. </div>.. <div class="content">..

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\wa-ui-install.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):18662
                                                                                                                                                              Entropy (8bit):3.853874020439017
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:GVtiO2qyGuMW2FnrjPfCfsdd5nwwCbvlOzNZLXQDCR1ZgpNC:GVXyRMBbOzCR1QC
                                                                                                                                                              MD5:8D4B42CC6D94C09CF0F1A5E24B6C793F
                                                                                                                                                              SHA1:681BEEB6D0969D187B60F1404FAB20F795EFDE7F
                                                                                                                                                              SHA-256:1B432A724B8C39947CA663ABFA488BC021BBBA35B807D5665EF66F8D6E1016EB
                                                                                                                                                              SHA-512:69EAB8D675AD374C8EF7545ABDC0768D595C1BC40F253F8BADC691B84265F5F4B448BB108C334BD290FC6247528A3FA837CC75AED335F8A9977BED0344445950
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:/* Installer UI */..(function (wa, $) {.. var ui = wa.UI = wa.UI || {},.. _instrument = wa.Utils.Instrument,.. _lrt = wa.Utils.Lang.ResType,.. _l = wa.Utils.Lang(_lrt.INSTALL).get,.. _window = wa.Core.Window,.. _external = window.external;.... ui.Installer = function () {.. var buttonId = "wa-installer-button",.. _this = this,.. RC_INSTALL_ERROR = -1,.. RC_INSTALL_DOWNGRADE = -2,.... open = function () {.. _window.ready(function () {.. //check preconditions.. var productName = wa.Core.WebAdvisor.getProductName();.. if (!_external.CheckDoWeMeetOSRequirements()) {.. _external.SetInstallResult(RC_INSTALL_ERROR);.. _external.ShowMessageBox(_l("ERROR_TITLE_CANT_CONTINUE"),.. _l("ERROR_OS_REQUIREMENTS"));.. _instrument.log("Installer",

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\wa-utils.js

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):15448
                                                                                                                                                              Entropy (8bit):4.444987919091517
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:BZwBjyfDzRj5csy4h11lidEaCaNz46UcEm7dO2qSFZC9OQ/xq+7:Wefpj5csy4DIE3oU6Um8Zqw
                                                                                                                                                              MD5:7BDB97F3EEF9FEF84EB08736C749CFDD
                                                                                                                                                              SHA1:BCA50FF8522D65E57875F324D70881435C9499A8
                                                                                                                                                              SHA-256:F348BD8C5CD22DE82D23B0A83BBA0E8EA4D6C2A52B8F917931F7D622FD9627B6
                                                                                                                                                              SHA-512:453E15A66765BD1F446FD549E9E0F5897308D6DBF83CA70A2BA492D32AA8ADAB8D7A3876DBA8EBBF66F88B2E2DAB4842C10439E40C8B8B6B7B15446EC52CD506
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:/* Utilities */..var _langResources_ = {.. checklist: (typeof _lrCheckList_ !== "undefined") && _lrCheckList_,.. options: (typeof _lrOptions_ !== "undefined") && _lrOptions_,.. shared: (typeof _lrShared_ !== "undefined") && _lrShared_,.. uninstall: (typeof _lrUninstall_ !== "undefined") && _lrUninstall_,.. sstoast: (typeof _lrSecureSearchToast_ !== "undefined") && _lrSecureSearchToast_,.. install: (typeof _lrInstall_ !== "undefined") && _lrInstall_,.. webboost: (typeof _lrWebBoost_ !== "undefined") && _lrWebBoost_,.. waiff: (typeof _lrExtensionInstall_ !== "undefined" && _lrExtensionInstall_),.. ut: (typeof _lrUpsellToast_ !== "undefined" && _lrUpsellToast_),.. overlay: (typeof _lrOverlay_ !== "undefined" && _lrOverlay_),.. newTabToast: (typeof _lrNewTabToast_ !== "undefined" && _lrNewTabToast_),.. ssToastVariants: (typeof _lrSSToastVariants_ !== "undefined" && _lrSSToastVariants_),.. pscoreToast: (typeof _pscoreToast_ !== "undefined" && _pscoreTo

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\wa_install_check.png

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:PNG image data, 14 x 14, 8-bit/color RGBA, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):558
                                                                                                                                                              Entropy (8bit):7.494810764492959
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:6v/7iIHftwTmWkW3O+xbR/GfmNFycqV7o5jNiXrj0IGDfjo/1:zT5+aVefmORm8bnGD09
                                                                                                                                                              MD5:F8AF1796D709A69C3FBDD16822596FD6
                                                                                                                                                              SHA1:D216CB9A49EF4223138BE20D027B3ABEEFAC7DB0
                                                                                                                                                              SHA-256:055E07F760351C3F33E708E4720D5A34A60ABD8D13F2FE05A473DFD5ED9714C2
                                                                                                                                                              SHA-512:FBD9C93490B818798F4614E6EEA7EF9FA05D535F50071806E763CD9EBEE478559F614EAC90720E4B5F88D803DB0AD459F1D1C67954C2C379B1BB435CCA74390A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR..............H-.....gAMA......a.....IDAT(.u..k.Q....1&.k..T..bO.K...DP....I..{.PRA..............QA..J/....eM.tS..7..v...y.7.7.f..R?......W.......N.....G...z.N.a._.X=.sg.5..r.k....Z...R....[..X..W....N....v...H.1x......L......R..@:v.w.....W........v.lc/F..b .C\.:.[Q.`..E`.L.J..!....<..m.q....R.&...""%F(^M.`..e.,N..q..y<.../.O:.mP..,A.QrZ}[u0..,3...S.K.\.EM5.!mH......}N.+j....p.O.E.......[..C.\x......nMi...~%.vv...|8...y.xV..v<ZZu.....y]@.1......]..).6.M.'.'.%o.T..5.Rq8..l..;...Ha......5......IEND.B`.

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\wa_install_check2.png

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:PNG image data, 14 x 14, 8-bit colormap, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):785
                                                                                                                                                              Entropy (8bit):6.380231936591206
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:nmwBSRPy8iSvgv+aYS0NFVO/6cgDHNUPZ7SCOr2zhxNoEMBxNB:mwBSRVL4v+/jNFVO/6cgDHWhbOKHCEIj
                                                                                                                                                              MD5:5367B11C1B0484E2B64AFFF761DB5B69
                                                                                                                                                              SHA1:CA05EC2A55FAB6A4035920C38B6FF198044DA594
                                                                                                                                                              SHA-256:1CAE0E0663BA559CA8FE7AD3A1E07AB23AB9E3DBADA1AA572AD9C2C5D51D5627
                                                                                                                                                              SHA-512:322DF7AFB16185EB4D39AA4881A27E04B1D310773FCFBB77D0F1C83237A56D100F6567091E30BF0DC6A11EA29A22A52BF091B66C5863823596108C155C031588
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR.............(.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....PLTE...#..$..%..$..#..#..$..$..$..#..$..#..%..%..$..#..#..#..#..#..$..#..#..$..$..$..$..$..#..#..$..$..$..$..$..$..$..$..$..#..$..$..$..$..$..$..$..#..$..%..$..$..$..#..$..$..%..$..#..$..$..#..$..$..$..$..$..$..$..$..$..$..#..#..$..$..%..$.....p~.S...NtRNS........................T....L..........K..T...S.....JJ...O....r)1N.T......L...P.....bKGDOnfAI....pHYs.................tIME........l.-....IDAT..-.g..`.F..o.PISC.[.........|..s.@.Jr.PM.3.Ah.&....dI.01..t...v.K.h.o[?..^.....Gc.&..8....A..<..r5...QY.F..n.8..@=A.l.u.....n.C.....>.o.4...&!.KUd.&R$>.e*o..T....:...~g....%tEXtdate:create.2022-02-16T15:21:59+00:00h......%tEXtdate:modify.2022-02-16T15:21:59+00:00..x.....IEND.B`.

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\wa_install_close.png

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):327
                                                                                                                                                              Entropy (8bit):7.1140535970703365
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:6v/lhPIcWn2ofLbzmoGGaKdwjXI76l4AXT8ctmzXxNuJpTqAp:6v/7DWn3btahecDAuJp1
                                                                                                                                                              MD5:C0708D1E58F1EF1BAB621620F3B09130
                                                                                                                                                              SHA1:0BEB49A1CC1E71F364BCF42B474890F35CB8CC3A
                                                                                                                                                              SHA-256:834380BD8B6F9BFEF000A555541AEC2BEC01DC46C91DCB7F950D109B81BAE5C2
                                                                                                                                                              SHA-512:241C93BC2677B1F0788C2C0DDD9A7FFCCC7A865DAD427EA8C89E437FC796FD12F80D2A962A8D02B1B2391E10CFF768F17E34BD45502A0E31D6E1C8F443C2AA34
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR.............Vu\.....gAMA......a.....IDAT(...On.@........=J.&....5....8A..M]{..s......Q#0.7...0.......yr).q8..s....sp.....W.u.q+..;|.5&..n{..{.............>..".^S......#q.6B...4.t....~e.[@B.&...L.o...h..8.......Q....+..b.i..MhxRaG....Y..F....,......G.E....`(....V.v.4.b.$..S.O.....Sh.B....IEND.B`.

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\wa_install_close2.png

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):272
                                                                                                                                                              Entropy (8bit):6.591404605834916
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:6v/lhPIcE/6TsR/nQV32e46OIoiMr6FRK7MhtCxllbp:6v/7DE/6Ts/nnPIcr6+ozCjz
                                                                                                                                                              MD5:F79A1953A8E6CC342847B4B00DDBD736
                                                                                                                                                              SHA1:9AC411CADB6652F4FDBD854300ADCB5C21C04BAA
                                                                                                                                                              SHA-256:4F8EF204C1884F868866D03B4D11DF1237480C1CAA38ADEC1C13444050105B88
                                                                                                                                                              SHA-512:DFB54D3D20FF53B867328945FE3D69B56055D5861EFCE2A069653B1792A5477AB4C3B73A3DEE82DD1377D1573099AB70C2F6C285C694DDBD0B1EE9667CFC4F2A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR.............Vu\.....pHYs.................sRGB.........gAMA......a.....IDATx.u.... .DW>...>.RRYJq>).>|E...!..3...t...a.?..w.!.P..../l....2....Q..ZS.%'.........y^.Q..H.T.V.D..W]..t.*X4t#9O;......=U%u0...f.......3`...[.S^..m..$..?[...{4.Y....IEND.B`.

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\wa_install_error.png

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:PNG image data, 14 x 14, 8-bit/color RGBA, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):428
                                                                                                                                                              Entropy (8bit):7.367179920202989
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:6v/7iIHbGI9XbxzlcdqzUCOXC5pC38WWn9:eGIrzlcdL4CZW9
                                                                                                                                                              MD5:0EF65600F5A2D01876B6F9EC668C9D2E
                                                                                                                                                              SHA1:31F378D2D6BE62F3A426523B1AA3D61323B2B9AA
                                                                                                                                                              SHA-256:17DC5C3BAA1D35CA60C7DEE7CC70B76446765769960FC5D4852E065478C871C4
                                                                                                                                                              SHA-512:7D9EC74CECF8DF49D4F8E676053573798A029D889E8676CFE90891EB68E49A2FE9AE828F38BB99851888B25A76581EBE2B62694D3C66D193016B4446004A9271
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR..............H-.....gAMA......a....cIDAT(.uR.J.A..f..&Q..*....h..... ...(.........K...!Vib...B...qf..{.9....|..3C............@..........5..8.b...z`-....s.ID..G....PEQ.;?1...p.h;..z6Z..4.X..c..$E3s.b..ry.|..yVy...0.Rr..W..S.......A.1.....s./".j..g.H{l...Q....d................fE..;..'+.).j.F...J......~.s..Y./...6.v....|......,...m..[m....n......D.E.OvU.n..W<.m..=h#.O..Zm.yj..@.tums.....IEND.B`.

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\wa_logo.png

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:PNG image data, 233 x 30, 8-bit/color RGBA, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):5361
                                                                                                                                                              Entropy (8bit):7.956335361585333
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:tXYxwio7C2guemm5poLpMmjxiN4f7DsCk7RkuxKBaKeVfGJiQmiMQ2qileA2I:toxpo9gKmsMmjwSXgyLBepQblA2I
                                                                                                                                                              MD5:0D8F8EFEB474FC9B2C825D7F2A875471
                                                                                                                                                              SHA1:ADBC30FD0131A01B3150753C7EBFD6EF648F0DE1
                                                                                                                                                              SHA-256:ACC40FDA844EADDF65B9580C484F1FE2E17358B352D99BABC6865BF0C74D9B00
                                                                                                                                                              SHA-512:90FEBC4B2165D37CBB1CF09295CF2F5B5713DD14A02CDC101318426CEB55D35B7C47B254D0F20CCB8297FC69EE77EAA5969FF98A0965D325C94AD81B6A56BA9E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR..............9B....gAMA......a.....IDATx...xTE....I .D..l,....(....Q.\..ftf...qA..D...?a..o.#.8..<.9:....A..."......KB...?7...M:......}7U..9..N.s.T..hZ"%$..@B...$$..@B...4!.UYY.E].Ln.%Qu.K.8....Z+I..m...m%v.6...K..]ki....W.}.y.%.O.1"dY..5...{...x.ef.X.~a..3K.u.l^.8'..?.z*#%.._.}.yT..Z..k..b..3{.{.>W_.,x,J......LM.T.>.x.....^..c.'...8^..(]...z(..._.......&..w..9..)..W.,s1.>.):.0.4.Y...nq...7....;......7)Xk.a...O...g.l...c.^..)8.%.e...h....U..7.O.'$.....]K.r0.Y5u..K....tH?.NSzwl.o..IG6...........X.(.z-.X....ju.+.Jpd.j......t.>...../?TW.0u..7........@B.. ....yYZ.iZ..:s...}_X2.O.....1kJ..3.*.9+... ].4.Y.2.....r>hM....}..-..|!d..i#U...F...Dr...5....D[..]..u._u....[.>.{5.xX...t.|L........}?........J.H?P.....M.n....-.......d......pQ....3..[...;vT.dg....5.@..0...[.c..1...U....i........a...o..[.PB.....E..^......."|........$..."V....tZ..`W...[...z.1..[~.Buu.[.........]/..x.(.`Z.A....`p...]RR.4u'u.]..u'...p..[sh..w.....g+

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\wa_logo2.png

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:PNG image data, 232 x 23, 8-bit/color RGBA, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2938
                                                                                                                                                              Entropy (8bit):7.909981061900822
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:nv/69bTJ0Ji4hnEhRHzXJH3ndGzDr9zHUeqr7zpiT7efEgo3cRE0+U9sLBCYv2ZG:vSdJN7HziDr3S9i/efLQcRZ9sowGdK
                                                                                                                                                              MD5:65938FC9439B2307513A95D515BCA1F7
                                                                                                                                                              SHA1:DDDFE8D64ED371E973C46B6726B60BB0C0810BF9
                                                                                                                                                              SHA-256:B2703E2E2A404B90EDAB7A67B23037C32BE2780F20CB15FFA6F6E44666B8EFB5
                                                                                                                                                              SHA-512:93F755F5E208CA08955684D7789F6B8AF49F542DD41AFD9D678EC417CB535734C9C8182B87EC2EA8B8AA9FA502AC8BA90E383A9977F7E01BFF393AF0D1F400BA
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR..............m......pHYs.................sRGB.........gAMA......a.....IDATx..\]R...o.T.yZ.'.8..y..f_"N.8.....`N.r... '.y...>,{..'.}....n..%[..!U.)..|.t...G..O?.. .~....@.N...a;..e.....1}.?....>.Ma...>.?..u.}L...m.N. ..8.>fe*.z..dr..u.D.1.R<.....T..J.......\.ZP..V}....M?...2..3.....)...T.yG.4...kO....t......b5...-....4F].q%c...-....v.2...O....g0...g.&R.2.n..<?P.q9.....+l3...X&T;...z."L).12..D..a.G3..OQ.Y....%..P.=.....2....%u.}4.(..N.!.)t....w...M.@.0.pt.a%..N...|.|\f+H.Rk.?..G..v.q.7.5.'..F}.....lm....rS[.4..F2..R.-..V......AU....!./.\S;...M/..K`..w...>.f'm..bf..y>..$D@......1....3.>...Cn!.:.........C*..-.PE14....$&}..?..I...._2.m.<....L.<.........92.p......jT....%.~..Q.U...6.4/.U..4L+HK.\i.z...Au.@>Z..Y.....kk...pQ..!....|..1g8...Uc$.....Y......9.....`0t..p..(...R.N....w`......\...<......M....-.95.f..W;xx>.7"..'..._z.REq.=e2..bg.S..r..VKcI.j.....\.O..T...q.>....H..6AE...{'?.....w.X.J...w.d.......O%..-%...1*.53..NPB.O.[M./.:..

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\wataskmanager.cab

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Microsoft Cabinet archive data, many, 2888349 bytes, 3 files, at 0x44 +A "\microsoftedgewebview2setup.exe" +A "\wataskmanager.dll", flags 0x4, number 1, extra bytes 20 in head, 165 datablocks, 0x1503 compression
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2909789
                                                                                                                                                              Entropy (8bit):7.999882080394675
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:49152:Jy3xnx08sXqiQVLyAQ6l7xcha+PVhtnN7j9wYsxqMJyCsccCNYWMve86XPPNCAMe:0px08sXRzH6l7xktL9wJMMJ0ccCNYg8Y
                                                                                                                                                              MD5:79C61E86FFF083CF026093633700E768
                                                                                                                                                              SHA1:5FAF5D8B117A44F550ECDFD6F8E26B31659857F6
                                                                                                                                                              SHA-256:80393D69C328FA3B3CD92C7BCA8790BEBE260810C8F60D0E000F47A72DEE591D
                                                                                                                                                              SHA-512:8F5AD89405EC1689023CEDDE9EF00635D11ED77E0D59946010AAAADA4414EAA730687B7794EA27A227073A0277BF1624B2A06FB7B51BA646D1CDDB98D2ECCB74
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:MSCF......,.....D.............................,..S.................. ?.........X.z .\microsoftedgewebview2setup.exe...7. ?.....X.{ .\wataskmanager.dll.Q....ZR....X2{ .\wataskmanager.manifest......I..[........."S`$..........XY.....$.$B9f.....0`..u$.*.V..w..g;`.......l.........d*<.*......@H..E..F..h....m.l.m...sy;3...r.....g....~.....ml..<hm.......@y.`7m66..-Vp...[Xm......b..`...Zq..7...f.....71K4..\......#.TD.U.E.{{..f..]...BeD0 d"...t@@..A....pr....B0"`Qy.rS..>a.5..@..u...*n...D....7..W+=.W.h.~.[?..SQ}o..I4....*.....vQo..w.K.O.Uj./......Q.?....T.^...l..'P........>.1....-....../...~....y=.~e....c...nVX./..U....4.o....T..O.....;..R..!..`.{l.....Cr.?.7:.Q.....+5.....>Z...,j.|.....-..L..+0.<L}..Ecc...V9s.kq..u.8.KUb...7.w..l..d?..`....K..+Kc.h.=F...~...\...\F.....j3.<.g..r.4.\zO..v.-..;..:.\..wdH&....AU...z.....0W\ X.'5W.J`>...z.......}..dr.."...*V....H.EI..[.A`.$[.fS ...z...^.Ez.....9..h..'.....6../.ut..(.c....0.b*.....'.dz0.!.`.....F~Z.....y.

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\webadvisor.cab

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Microsoft Cabinet archive data, single, 1209 bytes, 1 file, at 0x44 +A "\webadvisor.manifest", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1503 compression
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):22649
                                                                                                                                                              Entropy (8bit):7.676715647816319
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:jWj6ki2HPviQUDvYz/oAM+o/8E9VF0NyYir+6ki29d1ikrdHsAM+o/8E9VF0NyfF:jWu2HiPvYUAMxkESa2PsUMAMxkEaSW4
                                                                                                                                                              MD5:6F549FF18B6C030B712D3B5AF5BF1996
                                                                                                                                                              SHA1:721E67AEA9BC65939FEE8C42BC6EC86BD5079406
                                                                                                                                                              SHA-256:18722F47BE40E8E5F062AF01E2DBE4F25A08C9CCB657CD4073BD1F3EC6C4B72B
                                                                                                                                                              SHA-512:A7CCB857769F190D30F07AF7F9930AF811D0C0DEEEC5F0C2632FF9FB616FEC703FBFF0249D738D0C2D2591536D8AB0E3038935A85ED94D425A80589A4689FEE3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MSCF............D................................S..........i..................X.{ .\webadvisor.manifest.6..]H...[......K..3.53..^U..Lw.@n...........\:..Nm.^../s..V.... 8..........`...N...8+.[.../.......&..Fo......B3...41V..$..4?............F..g......*........t.M...}...xj.....m.T.wY.D.u.. ...*.uP...K....Pm..j ....m_...$<.e9j....r....M...h#O..}..4...Z.SfJ4...<.L..!.......S.$..l.j..bs10K..4%^.....;#J|.$1..|..f&l..E....T7.=. ..Z.r....H.../..-..R.<...%i*..b.(?......&.Az.W.........V.j.._.B..N6jFV....v|b...(...W.v..FtgYwC...].'.o@`....D....-J..p(;....\'K..l.\1aw...u..s......w.H.P..a...y}...dQR.....A...E...C.....=`.e.............=]Q*.Z.S.v.o;?..=A..IlA4}l@....D.........C.E...|..v.I.].+.3t.......9E#.u..$.@.E.n....Yl..}.x{..}...Ly...l."e....}......... .VF.>...m?.t)..V...].s.s....|..0.=..5;._P .s.......t.1....z[)..h.v...5vXv.5.OwO.....r.k.c.z.3..L.!...F.}a.%a0.....!I..d.W..3m.@j....ET...f....J....4...O..X...D......U..O\K8.r.BZ6.....A.,../...#....QP....B..

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\webadvisor.ico

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:MS Windows icon resource - 11 icons, 48x48, 16 colors, 4 bits/pixel, 32x32, 16 colors, 4 bits/pixel
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):99892
                                                                                                                                                              Entropy (8bit):3.9749743269785345
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:JLBqG5eVRjB/jZRj0t4kgU1l50AIDP88+2Y:JLBh5eWgU1B8+2Y
                                                                                                                                                              MD5:236FC5ABB597615A608DAB7BE98D5FBC
                                                                                                                                                              SHA1:18D3D1CF56898B264A24DE24DC13E4B9B7EED768
                                                                                                                                                              SHA-256:06ADAB20CB028B5DC61762691E8C8A6157EB1199526F7C773338B9BF51BD63C6
                                                                                                                                                              SHA-512:155766AA5659BB9E298AEDE4064832168002EEDEE836710C2259446FC35437AD70C04454DEF2D9EB40A83A029351EA1726D65ACBDB8FE8217C016FD4986F7F4E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......00......h....... ......................(.......00.............. ......................h...~"........ .n....'........ .(...TC..00.... ..%..|K.. .... .....$q........ .h......(...0...`...........................................................................................................p......................9Yx...................yyy9Y..................yyY.yy57...............s.....y.yy.............y9Y9Y5..9y.w.............9yyy.....................y.9qy....yy5............yyy.yqy.y.Y9yp...........y.xy....9yyY5....yY9.y.9.......yq....p....9yyqqyp......y.yy5.p...YyY9..p.......yy9Y.Y.........p..............p...Yyy.p...............p...99Yw............y9S.0...................yy..p....yY8............yyS.p...y9y.............y1......y.Y8............yYy.p...................y9yyp...................yyY.p...yyy.............y9yq....9Y.w............yyY9p...................y9yYp...................yyY9p...................y9q.....................yyYyp.......................p.............P.....

                                                                                                                                                              C:\Program Files\McAfee\Temp1561643107\wssdep.cab

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              File Type:Microsoft Cabinet archive data, many, 581545 bytes, 3 files, at 0x44 +A "\wssdep.manifest" +A "\win32\wssdep.dll", flags 0x4, number 1, extra bytes 20 in head, 46 datablocks, 0x1503 compression
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):602985
                                                                                                                                                              Entropy (8bit):7.998822395826606
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:12288:pMSlImSPlGm7gr6r/DuKUjEQs2ghhTuubFa4fjHeNN/BxQG/1/Q0:7STG6Hu/EGahThjHeN6GO0
                                                                                                                                                              MD5:33D498A921CDFA94A8D4C2E95D5D4AC2
                                                                                                                                                              SHA1:448ED9CDEB02DCF6E258DDA3736891DA0EBEB256
                                                                                                                                                              SHA-256:FFEB6C1CD60A753EEAA12E60EE710C8816C833D5D1648E04E8450E0EA2897FFC
                                                                                                                                                              SHA-512:605F08C1A24037B5B8D328E9D5153E643BEC74BBEBA20F06B0CFB7D33B5E8D74C46870EC57FEF0FB684455B00125E14C31AA76990969B1186729C804FA0F9AF9
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:MSCF............D................................S.............................X9{ .\wssdep.manifest............X.z .\win32\wssdep.dll.p....".....X.{ .\x64\wssdep.dll..%...<..[...4....."C`3..k....]..4(.....F.4......j....$`Y.AHe..#e...#..'.;..;...........H..$#.dH..P...q)....8C........G.....u.q>u..:;'|....|.d..K.ip^!..k.[..]}...Z..>.(....R...V.(d....J....j.l:.4.(....d..R.A.....N...........*0..{......}_..5.rs..z..-M.T$U.t..LP2.....x.IC......$cx..X..#....P...^m......4.D;f...$Djy.&N..._...M..BJ{..6..z6.......?....lOO.CS...?.Pe.}....l.........=.g.|qc..j.....5U.9A.%..F...}....U.k...u.U..V>p........._....>},.8...nJ.y...u....8.!J2..!..N..C..P.............1...*S*1...$..Wq.....^...L/.s.[mqfJ.........F]...V,..s.Ns.[(.?.N(.....p.9]..WG....[...>....Pf..vR<..A.. .@..M[;.)...-.....g{...}OZ.....s.....Ujl).~&.E............|..O.....~......]uZo...|.S.&..&....L.V0.R.R...*.....nK1Jk..2.rV....%..0_...2P.KM...1.......Rb.w&...@..H#w..5.i&S<..9.B5r..L.3e...

                                                                                                                                                              C:\ProgramData\AVG\Icarus\Logs\icarus.log

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (608), with CRLF line terminators
                                                                                                                                                              Category:modified
                                                                                                                                                              Size (bytes):1331407
                                                                                                                                                              Entropy (8bit):5.386372926170353
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6144:h9L0Jcvj83VpeLbcDewblZJxWXucDDDGN+nVCBbTX8DfwxMCtyrS4:MblncDDDGNgVCBbTX8DfwqCtyrv
                                                                                                                                                              MD5:C3663CB857067ACE9C48712084237606
                                                                                                                                                              SHA1:16D82A01BA4777ADBF69F526B9AD5C7A7E3340D7
                                                                                                                                                              SHA-256:19BE1F277E61BAC769409589C5A5C0F3A98E031BDFF219AD03C52921843C9014
                                                                                                                                                              SHA-512:932E0245B8D28CAC6324D536044907F8B28809208C13941838622C788E4FEEA5E7D5AC95FB6A8D1905C73A7486931D7F6A2478B496A4AB05446301D76E076F33
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.[2024-07-18 19:39:34.879] [info ] [entry ] [ 7884: 7888] [585FC6: 35] Icarus has been started...[2024-07-18 19:39:34.879] [debug ] [settings_lt] [ 7884: 7888] [D78F7E: 190] generic accessor for scheme registry set..[2024-07-18 19:39:34.879] [debug ] [event_rout ] [ 7884: 7888] [70F8C0: 49] Registering request fallback handler for event_routing.enumerate_handlers. Description: event_routing_enumerate_handlers_handler..[2024-07-18 19:39:34.879] [debug ] [event_rout ] [ 7884: 7888] [70F8C0: 49] Registering request fallback handler for event_routing.enumerate_handlers2. Description: event_routing_enumerate_handlers_handler..[2024-07-18 19:39:34.879] [debug ] [event_rout ] [ 7884: 7888] [70F8C0: 49] Registering event handler for app.settings.PropertyChangedValue...[2024-07-18 19:39:34.879] [debug ] [event_rout ] [ 7884: 7888] [70F8C0: 49] Registering event handler for app.settings.PropertyChanged...[2024-07-18 19:39:34.879] [debug ] [event_rout ] [ 7884: 7888] [70F8C0:

                                                                                                                                                              C:\ProgramData\AVG\Icarus\Logs\sfx.log

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe
                                                                                                                                                              File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (1464), with CRLF line terminators
                                                                                                                                                              Category:modified
                                                                                                                                                              Size (bytes):13859
                                                                                                                                                              Entropy (8bit):5.576456539328432
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:TEkuYsEbdbsEKHKLPKWr3r+qrqmrw0QrArGrt9XyYd:TEq1BQEKHoyWTSqmmkX0SZ9XyYd
                                                                                                                                                              MD5:D69C35135846C7C3F605FB010A6168CC
                                                                                                                                                              SHA1:D09589A878642199E418DBF6DF61F7AA5D9C4CA3
                                                                                                                                                              SHA-256:45129A2467B6E894AA05E999568EDD9F38BAA9C39545DDF2C96F9FBE380BD62E
                                                                                                                                                              SHA-512:CAAB4DE1000E65FE24EE3C6D1CCA57C8FE35AF2B57D65B5FB90926B25DD119648418F737134ACF7EFE99639E762FCFE9B6122830EE327C333753196A88B3F359
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.[2024-07-18 19:39:09.888] [info ] [isfx ] [ 824: 5312] [B3FBBB: 180] *** Starting SFX (24.6.7511.0), System(Windows 10 (10.0.19045) x64) ***..[2024-07-18 19:39:09.888] [info ] [isfx ] [ 824: 5312] [B3FBBB: 181] launched by:'6576-C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exe'..[2024-07-18 19:39:09.935] [debug ] [device_id ] [ 824: 5312] [1FA838: 70] Storing the new fingerprint..[2024-07-18 19:39:10.154] [info ] [isfx ] [ 824: 5312] [E4B7E3: 34] SFX started with command line '/silent /ws /psh:92pTu5fbOaMVqHXWzRazGwcsjZOgyQNZV0BXrS1y4TWZ27PXSitlzA5vE30PraTCAoRM4emN7pEfhI /cookie:mmm_irs_ppi_902_451_o /edat_dir:C:\Windows\Temp\asw.481015ae89dc80a3 /track-guid:1840c678-d62a-4945-8e4f-36eaf3f0c4a5'..[2024-07-18 19:39:10.154] [debug ] [isfx ] [ 824: 6724] [E6824F: 62] Sending report data: ({"record":[{"event":{"type":25,"subtype":1,"request_id":"00b12ee3-6193-423d-b568-4f44853c6cf2","time":172133799563

                                                                                                                                                              C:\ProgramData\AVG\Icarus\settings\proxy.ini

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe
                                                                                                                                                              File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):278
                                                                                                                                                              Entropy (8bit):3.4584396735456933
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:Q9oPdKwo/e7nwY0ow+lGUlYlUlulnvm4HflKmaGHfltNv:QCFKwh7CaI/VJNKKHNX
                                                                                                                                                              MD5:B8853A8E6228549B5D3AD97752D173D4
                                                                                                                                                              SHA1:CD471A5D57E0946C19A694A6BE8A3959CEF30341
                                                                                                                                                              SHA-256:8E511706C04E382E58153C274138E99A298E87E29E12548D39B7F3D3442878B9
                                                                                                                                                              SHA-512:CF4EDD9EE238C1E621501F91A4C3338EC0CB07CA2C2DF00AA7C44D3DB7C4F3798BC4137C11C15379D0C71FAB1C5C61F19BE32BA3FC39DC242313D0947461A787
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:......[.P.r.o.x.y.S.e.t.t.i.n.g.s.].....A.u.t.h.o.r.i.z.a.t.i.o.n.=.0.....A.u.t.o.m.a.t.i.c.E.n.a.b.l.e.d.=.0.....C.o.n.f.i.g.U.r.l.=.....F.a.l.l.b.a.c.k.=.1.....P.o.r.t.=.8.0.8.0.....P.r.o.x.y.N.a.m.e.=.....P.r.o.x.y.T.y.p.e.=.0.....U.s.e.r.N.a.m.e.=.....U.s.e.r.P.a.s.s.=.....

                                                                                                                                                              C:\ProgramData\McAfee\WebAdvisor\saBSI.exe\log_000B005C003C0011001B.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):211
                                                                                                                                                              Entropy (8bit):5.133676006884034
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:rtRVjT34+IBk2JM0RG0DKhSm0tRVjTZZVjwOrADGq:ZRVoLBk2JTDFnRV5rjhroZ
                                                                                                                                                              MD5:6302292359E3C9D0DB7EE5A6C5D0C163
                                                                                                                                                              SHA1:165D3672A8B938A3C1FA9955132F2ACF18A3C8B5
                                                                                                                                                              SHA-256:932B36ADC70C61883EE8B40CB5BBB0B6E88E0DD8C3CE285029204EDD17C4F1D2
                                                                                                                                                              SHA-512:EB9ACA361BE1E19317761504DC28EE9C1CD33AF9B2FAB3432A25F3FA8A190DEB95A675FDA7604D92921CCA39DE133F66047A83DF00EE247E231B692B2E0D54C5
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:[ERR][20240718 17:26:31.293][ProcessUtils.cpp@210]: Failed to get executable filename for process with id 476. Error 31..[ERR][20240718 17:26:45.507][HttpsDownloadFile.cpp@200]: Unable to open HTTP transaction..

                                                                                                                                                              C:\ProgramData\Microsoft\Network\Downloader\edb.log

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1310720
                                                                                                                                                              Entropy (8bit):1.3073825863041773
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrH:KooCEYhgYEL0In
                                                                                                                                                              MD5:5DCF086F25E9B96960DA1FD8D7A2126D
                                                                                                                                                              SHA1:7C537BD2590EF9D99B18F0ECDEE751BFEA87E26A
                                                                                                                                                              SHA-256:7DA90886BDA1A91EB4A0744DABD98BB5A2871431BEFA348680A6E2B22268BAD3
                                                                                                                                                              SHA-512:CCFEDD49019BBF8F2004B1A152083F7BA7B4D967A8B7BD9895CF05F4BFA8B1EAF0C44402C051E46B5D227C88A0523305E8F9BEFE84642B7549F87365A43E5B36
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                                                                                              File Type:Extensible storage engine DataBase, version 0x620, checksum 0xd06ab0da, page size 16384, DirtyShutdown, Windows version 10.0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1310720
                                                                                                                                                              Entropy (8bit):0.42217209001900846
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:5SB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:5aza/vMUM2Uvz7DO
                                                                                                                                                              MD5:CF334B8D14AA6247005B311C6BC9B262
                                                                                                                                                              SHA1:DE2900566EC627D1995C29F7F7C16F88668EE761
                                                                                                                                                              SHA-256:2F3AAF91806A8BDFE82F1CEFF329EA9C2069AD69FF8093A1B63DD101083DFF19
                                                                                                                                                              SHA-512:33CC36EC05E59577CF694486AD3DED72D6FF561987B133B02750218344BD286760A4A6D983AD2D3D27D2B028822B640A9BEF7887D99C0450A84A1FC1AA4D1943
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.j..... .......A.......X\...;...{......................0.!..........{A..'...|..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{.......................................'...|...................4.a.'...|...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16384
                                                                                                                                                              Entropy (8bit):0.07760297389046629
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:TvYeD1S6nagCjn13a/WVn/YllcVO/lnlZMxZNQl:DzD1vav53qqQOewk
                                                                                                                                                              MD5:05838037E2E4783A7F7ABB6CD56E4BB0
                                                                                                                                                              SHA1:50107741C596EEB7824C18DF7E535D1C0749AF95
                                                                                                                                                              SHA-256:A0F7F7CE847823B31B889F1FD05BAE5269DB2AFA9A4325D68070C70C659704E5
                                                                                                                                                              SHA-512:E35938D78831DC8F7F2A8064A594CAB27C7763F788372AE896A47FF1982CB7EF813C9B0689A876CC77BC1B7D4490B8D957EE6CE575C838AC46FC7B3A840B2BFB
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:)wcc.....................................;...{...'...|.......{A..............{A......{A..........{A].................4.a.'...|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BitComet (64-bit)\BitComet.lnk

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Tue Jul 2 07:06:04 2024, mtime=Thu Jul 18 18:38:47 2024, atime=Tue Jul 2 07:06:04 2024, length=27838352, window=hide
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):993
                                                                                                                                                              Entropy (8bit):4.611112252605766
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:8mFMudllkduXhUAYMdd6HddbT7Eekzem:8mFMudlgC1pdd6Hddf7Eeky
                                                                                                                                                              MD5:7C3C72A458E9AD16F079DA5F0F243147
                                                                                                                                                              SHA1:976F60A717EFA1474D8290EC9785E4CAB2F83B5E
                                                                                                                                                              SHA-256:B5D92EE1FA6EBCFB2D1B9057B202A985D6A0C31FE445B5CB1204F11E4E3124B9
                                                                                                                                                              SHA-512:9B5AD8924AD295BA3F4398AA59222EBC24372B793DD692231FFEFBFEF92DB6A2980B78AE25F7C527ABCB06008F53F1670FB14D2A8FBF5F0329B02785BF333A43
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:L..................F.... ....>;.V...GR..J....>;.V..........................{....P.O. .:i.....+00.../C:\.....................1......X...PROGRA~1..t......O.I.X.....B...............J.....l...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....Z.1......X...BitComet..B.......X..X.....y.........................B.i.t.C.o.m.e.t.....f.2.....X.@ .BitComet.exe..J.......X.@.X.....|.........................B.i.t.C.o.m.e.t...e.x.e.......U...............-.......T...........4..!.....C:\Program Files\BitComet\BitComet.exe..5.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.B.i.t.C.o.m.e.t.\.B.i.t.C.o.m.e.t...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.B.i.t.C.o.m.e.t.`.......X.......258555...........hT..CrF.f4... ..T..b...,.......hT..CrF.f4... ..T..b...,..............z...1SPSU(L.y.9K....-............H...>jP....J..dQ....A................B.i.t.C.o.m.e.t...T.o.a.s.t.s.N.o.t.i.f.i.e.r.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                                                                              C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BitComet (64-bit)\HomePage.lnk

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Thu Jul 18 18:38:52 2024, mtime=Thu Jul 18 18:38:52 2024, atime=Thu Jul 18 18:38:52 2024, length=50, window=hide
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):871
                                                                                                                                                              Entropy (8bit):4.498059592588616
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:8mo7zRudllkdU0a/BYUAnMdd6UddbbBm:8mo7zRudlgAsMdd6Uddx
                                                                                                                                                              MD5:E077892B95E796BB662BDBBBD6776DCD
                                                                                                                                                              SHA1:6BE10AADE6F2FC1E0667AA52BC86ED66B43DEC1E
                                                                                                                                                              SHA-256:006657B97F1C77B8888781DC2A19A621EA0AB79F2DA96E1FBC83AC5B0D3EBC45
                                                                                                                                                              SHA-512:E711085855FF333FA359C5DA5B4C0BD7DE6E65A70F259A9899B277E32D0854A3123A58AD6DF77464F023613AF6DA333D48D8A64615CD91636E0CB275BE663696
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:L..................F.... ....B..J....B..J....B..J...2.......................{....P.O. .:i.....+00.../C:\.....................1......X...PROGRA~1..t......O.I.X.....B...............J.....l...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....Z.1......X...BitComet..B.......X..X.....y.........................B.i.t.C.o.m.e.t.....f.2.2....X. .BitComet.url..J.......X..X.....z.........................B.i.t.C.o.m.e.t...u.r.l.......U...............-.......T...........4..!.....C:\Program Files\BitComet\BitComet.url..5.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.B.i.t.C.o.m.e.t.\.B.i.t.C.o.m.e.t...u.r.l...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.B.i.t.C.o.m.e.t.`.......X.......258555...........hT..CrF.f4... ..T..b...,.......hT..CrF.f4... ..T..b...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                                                                              C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BitComet (64-bit)\Uninstall.lnk

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):575
                                                                                                                                                              Entropy (8bit):2.7607342294511947
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:4xtCl0TMl//A9LY/dlrtmlXUvzlbfMy0fK1KRSAthbdlrT9dRSAVlubdlrTc:8wl0TkXXdpsULlbMK4ZbdpT9dsbdpTc
                                                                                                                                                              MD5:0DCAD8DC4551524A7D445CF4E54FF4CD
                                                                                                                                                              SHA1:A367FF4248F2DFF1FBBCD140A65AEDBE9A861F19
                                                                                                                                                              SHA-256:9CA8CB7BB3711E5DE4A97955533B35B0D521A1E0CEA186B0E75E60EA4ABEC268
                                                                                                                                                              SHA-512:52C8C77CB676B948FF1B4472C125DB66DBBCE68C8FEC41480624E1C9906908EAB8F854E16B2B457A9C5413E686D00285992C64DFD0217A05386E94FB26A39934
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:L..................F........................................................Q....P.O. .:i.....+00.../C:\...................h.1...........Program Files.L............................................P.r.o.g.r.a.m. .F.i.l.e.s.....Z.1...........BitComet..B............................................B.i.t.C.o.m.e.t.....`.2...........uninst.exe..F............................................u.n.i.n.s.t...e.x.e.......3.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.B.i.t.C.o.m.e.t.\.u.n.i.n.s.t...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.B.i.t.C.o.m.e.t.....

                                                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_a1c3ebdaac744fa4dd3533ed4cb8388313435ebe_1d5d356a_7e56e7d9-7c90-4439-b979-a4ad45ed4afe\Report.wer

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                              File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):65536
                                                                                                                                                              Entropy (8bit):1.401908081696736
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:OybRfWr07I3g6jcfecrXRao/dzuiFPZ24IO8t:tbRfW47Cg6jeXRLFzuiFPY4IO8t
                                                                                                                                                              MD5:1616075E291F3F15C929A971326B7DE4
                                                                                                                                                              SHA1:742041D0B4502B7A6CD276A0B907493C7C3D046B
                                                                                                                                                              SHA-256:7169A783960EBAE0A1CBF6561FD2860ADC0639408CA5DAF82AE36A7F7D75FAEC
                                                                                                                                                              SHA-512:C41B8F296DEC99C0DFA740283CD7677A91DE4315AC31B99D559AB0C0FB58FB15E9D41B95C68D9FB7B34E1D1DD5BF353156B01AF04241AE4E1AB34B0D93E38BDB
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.5.8.0.5.1.6.9.1.8.8.8.3.9.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.5.8.0.5.1.7.0.1.2.5.4.6.7.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.e.5.6.e.7.d.9.-.7.c.9.0.-.4.4.3.9.-.b.9.7.9.-.a.4.a.d.4.5.e.d.4.a.f.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.b.d.3.a.5.7.b.-.7.a.f.a.-.4.4.d.8.-.8.6.b.c.-.0.7.a.1.0.3.2.d.9.a.7.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...R.i.s.k.w.a.r.e...O.f.f.e.r.C.o.r.e...5.0.0.2...4.6.9.8...t.m.p.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.5.4.-.0.0.0.1.-.0.0.1.4.-.d.7.1.3.-.d.1.f.f.4.9.d.9.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.3.9.7.1.9.9.

                                                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_c59b53c17e38b5761adf95ece6eaada878dca_1d5d356a_02410c9c-25c9-4dab-a05e-b498e51d1b14\Report.wer

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                              File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):65536
                                                                                                                                                              Entropy (8bit):1.401697848594341
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:uuGRf5X0IJhh6jcfecrXRao/dzuiFPZ24IO8t:URf5kIfh6jeXRLFzuiFPY4IO8t
                                                                                                                                                              MD5:962585229F093E808371D227F8CB94DA
                                                                                                                                                              SHA1:A4AC7C7FC0D1F9FCB105D19D14853AFADD5832CF
                                                                                                                                                              SHA-256:D2B9780A162CEBA705980FE22465D5FA490C182DA69F9B336004FDEDEE49227D
                                                                                                                                                              SHA-512:BC521773A9D41B8CED50B31E7C768ED5EE650E67EFF07CE08482CB37EFB09CBFCC65D3DBDA4C5B37DCD20D70BA60D3855D86C5EAFF75F46C113BB6058981DC56
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.5.8.0.5.1.5.4.6.9.1.1.1.6.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.5.8.0.5.1.5.5.6.1.2.9.9.1.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.2.4.1.0.c.9.c.-.2.5.c.9.-.4.d.a.b.-.a.0.5.e.-.b.4.9.8.e.5.1.d.1.b.1.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.1.9.1.5.8.4.2.-.7.8.a.8.-.4.6.b.3.-.b.c.8.1.-.f.3.f.c.b.9.a.9.c.e.7.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...R.i.s.k.w.a.r.e...O.f.f.e.r.C.o.r.e...5.0.0.2...4.6.9.8...t.m.p.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.5.4.-.0.0.0.1.-.0.0.1.4.-.d.7.1.3.-.d.1.f.f.4.9.d.9.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.3.9.7.1.9.9.

                                                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WER13F5.tmp.dmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                              File Type:Mini DuMP crash report, 15 streams, Thu Jul 18 19:39:15 2024, 0x1205a4 type
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):129690
                                                                                                                                                              Entropy (8bit):2.1837215202680236
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:iRv6xbZRD7eb1WsR9e25RhGaYfbWgfuXQtct:cyFaBR9e25RhGaYDWgfuX
                                                                                                                                                              MD5:4E6321DB5873FCAF7D43B0C0E39C1EA1
                                                                                                                                                              SHA1:BBA8BC2B0EB487C5271D2D419C2226F9E5B16DA4
                                                                                                                                                              SHA-256:6B27683A5E8722B9D8F09F4DDE608EF6EC19151F0C4A06ACE5D1D46817B3C962
                                                                                                                                                              SHA-512:79E66907ADD90CC55BA4A80EB944D9BB82A5434C90BA3D9FD8CB460B4C747E45E1D2A9882E709E024B4D61FC797D4676BF10A93A7238BDBBBE0189DC4BE08F86
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MDMP..a..... .......co.f........................(-..(.......t...P6......t...&k..........`.......8...........T............j...............7...........9..............................................................................eJ......H:......GenuineIntel............T.......T....o.f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WER15BB.tmp.WERInternalMetadata.xml

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                              File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8620
                                                                                                                                                              Entropy (8bit):3.699037349421289
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:R6l7wVeJrt6yUee6Y3V60AIgmfFyxpre089bmosfvcim:R6lXJx6yk6YF6ZIgmfFnmbfw
                                                                                                                                                              MD5:8952FEEF279B26C43289B6B60022C711
                                                                                                                                                              SHA1:1EC4363DF83352C9DD76CA2EAAD439BA25AD8B4F
                                                                                                                                                              SHA-256:D506B9C32378320F008B26C0174723A078A7D9492E8F12DDC223FE87F3F1B920
                                                                                                                                                              SHA-512:826DDAF9C9BA36DA5C69AE6531627E6AC87782D8520BF1B388B9477BF78D208720F8473D732C4B16332248A56DBD098228AD856D8075A539B5E11D8C69F39EA1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.7.4.0.<./.P.i.

                                                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WER15EB.tmp.xml

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4941
                                                                                                                                                              Entropy (8bit):4.528166339916641
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:cvIwWl8zsgJg77aI9nUWpW8VYVoYm8M4JgXNvXjFu+q8KXdXLw5B2Dvhhyd:uIjfmI7FN7VCFJgXtXAjXdXGsDvhhyd
                                                                                                                                                              MD5:61178085AEAA4C1BBC950B3EB2C897EB
                                                                                                                                                              SHA1:3B50383EA8A02F61033E6B7FA54E5F3B17BF0BF4
                                                                                                                                                              SHA-256:E00A286E3E683E212F631972FFA6D63ADA9A0E593789C62CEF55075A9D6FA2E5
                                                                                                                                                              SHA-512:B8CED39798F8C69DD13ED5D7B63DB32A1CE21EA1BEE38E95EEBDBA7D2B1BD9813D95262431CE57361926B5CB38332ECF9CF9A311EEC82CDAEBCAC1ADA3EE1763
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="416801" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WER15F8.tmp.csv

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):81776
                                                                                                                                                              Entropy (8bit):3.0965222334777103
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:ijE00tJZ3CTngW6QDg4oFKmjjJLZJtKx31k:ijE00tJZ3CTngW6QDg4oFKmjjJLZJtK4
                                                                                                                                                              MD5:6AE2891C5DA61684151A3CFED3168E1F
                                                                                                                                                              SHA1:6CC9973A0E018906776E524C9EE3C5B18959E58E
                                                                                                                                                              SHA-256:0CBC37BEC992B44C3818820D46AAC616628D8C4AE3D6053C919F81866B8A9870
                                                                                                                                                              SHA-512:57FEF30B4EC1F57740A206B1D713F8E970E339FD9615F513C6BAA9F45F77A1A3264C0012DA6827257433D14ACFBCB2E784F5324B8F017E8D4F7649747D31ADC2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WER1676.tmp.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):13340
                                                                                                                                                              Entropy (8bit):2.6875519734052262
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:TiZYWUZlhzqiYJYxiZWARHBYEZLBBtKiL3QKK5kwDl9aiZ47Mh8XI4d3:2ZDUpe8sZB+XaiZ47Mh844d3
                                                                                                                                                              MD5:AFD843C07B9FF223760BE883B637E2E7
                                                                                                                                                              SHA1:0B38A0D8EF4AFD0BBC53F3C8FEEC9303DC5E84C4
                                                                                                                                                              SHA-256:427D707E7226D3A265C1EEA71F7111716CC313AED0CEB1099A25133CA5E5B3DB
                                                                                                                                                              SHA-512:2739A4718999ABDF350F76A82148E800E3CEF102F62D77F6061E254ED9463F9235E7E342D895313DCC9FED40C84976D82C1DC2608253198B0D5C4803203E7EC0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WER4C0C.tmp.dmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                              File Type:Mini DuMP crash report, 15 streams, Thu Jul 18 19:39:29 2024, 0x1205a4 type
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):125612
                                                                                                                                                              Entropy (8bit):2.191945214015853
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:wRv6xbZRDOJeb1WspQe9QgRM7SLmT73MnWS:WyFaIBpQe9QgRqa83M
                                                                                                                                                              MD5:A659EE43F7D1EF43696C71D744BB4701
                                                                                                                                                              SHA1:32744667441965A282A2C76F532060F990B53794
                                                                                                                                                              SHA-256:08C36774738E097785C79ACD34C7AFED6D10BA46CEB6D8C2AE827AECC9743EF1
                                                                                                                                                              SHA-512:3261BCA33B21A0035D3AC150EB219E6947082BA7A940AC9A3C6126360AC5D89F9C24CBB0ABF44A734F7B0F63FC1E50D0C5DFF3F9BAAE7BF3114730F83654770F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MDMP..a..... .......qo.f........................(-..(.......t...P6......D...&k..........`.......8...........T............j...............7...........9..............................................................................eJ......H:......GenuineIntel............T.......T....o.f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WER4E01.tmp.WERInternalMetadata.xml

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                              File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8606
                                                                                                                                                              Entropy (8bit):3.7013120873197938
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:R6l7wVeJrB6z0ee6Y3v60AIgmfBAWpDQ89bJosfr1jm:R6lXJt6zE6Yf6ZIgmfB7Jbfrs
                                                                                                                                                              MD5:52CDB86D29453EDD465A5C31FAC86D2F
                                                                                                                                                              SHA1:84ED2CFC6422C3EB28F440FF934F102C03745F1E
                                                                                                                                                              SHA-256:4A73CA1E9BCDA4EC93A6A283A77CFFBF919B809C3A50D6BF9E293681510B64C1
                                                                                                                                                              SHA-512:14C863DBB0141E6C8CEA1D5CECF3213F3FDFD5B453E3245F75BB03C62755980FB0B474ADF7DA2BD33CDDF8F993F8D459A7822A5D8D36E18472D2E4EEB5C3E6B3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.7.4.0.<./.P.i.

                                                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WER4E50.tmp.xml

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4941
                                                                                                                                                              Entropy (8bit):4.528559988115399
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:cvIwWl8zszNJg77aI9nUWpW8VYcYm8M4JgXNvXtFxI+q8KXdXFw5B2Dvhhyd:uIjfznI7FN7VgJgXtXpIjXdXgsDvhhyd
                                                                                                                                                              MD5:1FEB58A829E8118CEAF87B85871E02EE
                                                                                                                                                              SHA1:41A5A430EAAEF50AA168BDB9A72FB2E00AC3BB14
                                                                                                                                                              SHA-256:41E7320F846CA6C5624A931ECB7364B37185893C778008EDF27AAE25897395D9
                                                                                                                                                              SHA-512:525038961F0F3AE4C598D745FE0C4ECFF47A37C174B8657958AD5E1C63A641B297BE21406BF97F9ECE953F1813B91D101AFD61F0791DDEC67E1F7A174B264F07
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="416802" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WER4E70.tmp.csv

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):87604
                                                                                                                                                              Entropy (8bit):3.0899252826806882
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:E+dIvRVe/KZ8DoQjPbT9/Fm78hJBdextsiwZ4:E+dIvRVe/KZ8DoQjPbT9/Fm78hJBder1
                                                                                                                                                              MD5:C65E136E1D9DDCB03E899793CCAB99F7
                                                                                                                                                              SHA1:C51C1ED7969A5049D81D2C51671E1F452AB9DC0E
                                                                                                                                                              SHA-256:DEF5CC8D7AF39635067EA13E3EEAF47EBE8216A77233D0D72AC1F3221B154CA4
                                                                                                                                                              SHA-512:3F709160102D29279E15793D3408C2FBF7EAAD4F4C8ED2E908C5BFC0C449DCF9A8CDEEFB3E6F6C1379A06EF3B39F4A1EACFDBA9F48AEEDF21837377F8D98DEEC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WER4F3C.tmp.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):13340
                                                                                                                                                              Entropy (8bit):2.6883644811378873
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:TiZYWGDX8dKYWYAWRHuYEZfstNimEB4HwyjlIVkaeZNKMTQVIzd3:2ZDGXB9oOuaeZNKMTQqzd3
                                                                                                                                                              MD5:AE4CADADB7D879997B7D748FAE9477CA
                                                                                                                                                              SHA1:D144EE02154B5E28D207E42759AC63C99436B503
                                                                                                                                                              SHA-256:418BD6306482283CBB49B6813D4074CB011CA95C13A3D4EA404070EE9713F213
                                                                                                                                                              SHA-512:E3833B12CEF0642B6F87E14719E45231BBEAAD519D716B809CF20260E40A33715E6F7756E915FD7C047857CFC41F3A49D52E11B1C0140D1EA5A350DBE7974A84
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                              C:\Users\Public\Desktop\BitComet.lnk

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Tue Jul 2 07:06:04 2024, mtime=Thu Jul 18 18:38:52 2024, atime=Tue Jul 2 07:06:04 2024, length=27838352, window=hide
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):853
                                                                                                                                                              Entropy (8bit):4.567227843055281
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:8mFeBYX6h9giNdpF4yLlkmYPWXhjEjArFSBbdpT6LbdpTbnBmV:8mFNudllkduXhUAUdd6HddbnBm
                                                                                                                                                              MD5:8A8BDA9CA2F8BF4FC6E3FDAE6957B32B
                                                                                                                                                              SHA1:B9B5C77452A436C1EE53AF94A5BC13484CF393DF
                                                                                                                                                              SHA-256:DE607C50FD45C66B7B666C53D20786D933BCC0E988E477DC479167F75FB52A38
                                                                                                                                                              SHA-512:A226E6EFCBF874D751A47C35ABA18A26039CF23D92B302CAC29EEDEBB659DC2DE31D8563E0E40643616508F9AA45E3EA2B261C270749BDC7E58E4402717DB300
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:L..................F.... ....>;.V.......J....>;.V..........................{....P.O. .:i.....+00.../C:\.....................1......X...PROGRA~1..t......O.I.X.....B...............J.....l...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....Z.1......X...BitComet..B.......X..X.....y.........................B.i.t.C.o.m.e.t.....f.2.....X.@ .BitComet.exe..J.......X.@.X.....|.........................B.i.t.C.o.m.e.t...e.x.e.......U...............-.......T...........4..!.....C:\Program Files\BitComet\BitComet.exe..,.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.B.i.t.C.o.m.e.t.\.B.i.t.C.o.m.e.t...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.B.i.t.C.o.m.e.t.`.......X.......258555...........hT..CrF.f4... ..T..b...,.......hT..CrF.f4... ..T..b...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C5C8CC0A7FE31816B4641D0465402560

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exe
                                                                                                                                                              File Type:Certificate, Version=3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1398
                                                                                                                                                              Entropy (8bit):7.676048742462893
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:ujsZPSIPSUcnA3/46giyfV4Hxk7P3Gus6acCQ4CXmW5mOgs:ujul2nQ4XfVkk7P3g6dB42mVs
                                                                                                                                                              MD5:E94FB54871208C00DF70F708AC47085B
                                                                                                                                                              SHA1:4EFC31460C619ECAE59C1BCE2C008036D94C84B8
                                                                                                                                                              SHA-256:7B9D553E1C92CB6E8803E137F4F287D4363757F5D44B37D52F9FCA22FB97DF86
                                                                                                                                                              SHA-512:2E15B76E16264ABB9F5EF417752A1CBB75F29C11F96AC7D73793172BD0864DB65F2D2B7BE0F16BBBE686068F0C368815525F1E39DB5A0D6CA3AB18BE6923B898
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:0..r0..Z.......vS..uFH....JH:N.0...*.H........0S1.0...U....BE1.0...U....GlobalSign nv-sa1)0'..U... GlobalSign Code Signing Root R450...200318000000Z..450318000000Z0S1.0...U....BE1.0...U....GlobalSign nv-sa1)0'..U... GlobalSign Code Signing Root R450.."0...*.H.............0.........-.0.z.=.r.:K..a....g.7..~.....C..E..cW]....%..h.K..K.J...j..a'..D...?".O.....(..].Y.......,.3$.P:A..{.M.X8.........,..C...t...{.3..Yk....Z.{..U......L...u.o.a.tD....t..h.l&>.......0....|U..p\$x %.gg...N4.kp..8...........;.gC....t./.....7=gl.E\.a.A.....w.FGs.....+....X.W..Z..%....r=....;D.&.........E.......Bng~B.qb...`.d....!N+.mh...tsg1z...yn|..~FoM..+."D...7..aW...$..1s..5WG~.:E.-.Q.....7.e...k.w....?.0.o1..@........PvtY..m.2...~...u..J.,....+B..j6..L.............:.c...$d.......B0@0...U...........0...U.......0....0...U.........F...x9...C.VP..;0...*.H.............^+.t.4D_vH(@....n..%.{...=..v...0 ..`.....x.+.2..$.RR......9n....CA}..[.]...&..tr&....=;jR.<../.{.3.E.....

                                                                                                                                                              C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C5C8CC0A7FE31816B4641D0465402560

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):264
                                                                                                                                                              Entropy (8bit):3.1537500202709894
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:kKz86WFkthurGhipWhliK8al0GQcmqe3KQjMIXIXL/:DYkt4rGIWzyZ3qe3KQjxXIT
                                                                                                                                                              MD5:9F7C8480D9E0A4D1E9C61CB5B69AE439
                                                                                                                                                              SHA1:0A3171D5F1CE5DB3507DD0445395225E2D5B3A72
                                                                                                                                                              SHA-256:21B4DE8CEF878131BD17A96284CB0C36EB88B8E4A9AA1A845F7654D67843055C
                                                                                                                                                              SHA-512:446ACC9AE3D81373A0FD132DC2751D64A843A6BE2501E2C5D549EBD12FE26F92C53F96CBB13C78B3FF0408023CC57B9391C49A1EBDB072C3876AD42864EED0DB
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:p...... ....v....0.<J...(....................................................... ......................N.....v...h.t.t.p.:././.s.e.c.u.r.e...g.l.o.b.a.l.s.i.g.n...c.o.m./.c.a.c.e.r.t./.c.o.d.e.s.i.g.n.i.n.g.r.o.o.t.r.4.5...c.r.t...".6.2.f.a.4.8.4.5.-.5.7.6."...

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\0b21b568-2b30-4b44-9eed-cb299a507206.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16452
                                                                                                                                                              Entropy (8bit):6.06828747556593
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:dtM7XKnG7EtlXrFJOg5+VCKP4gW5CiUMzcBhqNBSMpfur4OJic:XM7X2zt1jOXtXi3zah8furJ5
                                                                                                                                                              MD5:41FD4CCFD5C968CE6518F2C8F3389B58
                                                                                                                                                              SHA1:7D9A7071F8AF39E80B2275ACFE16A32232455133
                                                                                                                                                              SHA-256:632CE1C08C974E298F5B17115F72E50127FF1F9255C382428C4C9CCFB66E6AF4
                                                                                                                                                              SHA-512:FB5FE0FF9764B2A898FF100190E59BF7124D77F2225D276CAC8E1B4406C3D9E5F00F16968253276F372ADD0EE2F011D8A218BEE6E81DF474FE9DEE76FC61AA65
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:{"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5WgIYys3bJeQH8gzYPwfpC896xXwllv1ws/Dov+UhC031uDZGRdc04LmqFm3Cjhfq008PV7a+5hhe79VoH4u4yk308t/Dk18EzpeL4EmYE9h5+MT4qBuMWAoynzi9yFf/z8N4+c7BnX5qaxMXjWWNuUeEuxFZB94cta8JqLbiF2zYWsrF0K38o0/KVgtVMF5aEI/vhxca+VLKhhZax1NWoKBRWhiA+wFYAyF6Jr5QUMoLgD5ho4CKIP73/CB+mNcHhjZo8gT1PSiPG+B5lF3C+VtqJ7pjlXJZ335PUBNA

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\19ed1932-936c-4f17-b5fb-284826b8d0bb.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):950
                                                                                                                                                              Entropy (8bit):5.748350049151981
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:YKWJu5rrtskJNqzVJskJBBV8eBPWaeCUWODLbvXmQQRCYfYg:Yqf5aJsAXpBPWZHD3vXB0
                                                                                                                                                              MD5:7FD254E5E895FCB8158F4E19B9222E78
                                                                                                                                                              SHA1:3A958AA816CDE7B298C1D33B57B27D5FD74ECDDF
                                                                                                                                                              SHA-256:795C4D3710B515D709D586F5897D5941DB3307D5040B04DB4382011219BA57B6
                                                                                                                                                              SHA-512:EADC9A11000DBDB5CCB1A3A7F83F7EB4240C3440C2767BBB8256E19CC2DDD975A08FA6FB6A37D9B017ECF17C3C733167DBA0F5530C8C1AF8FE61F11BCF029BEC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAG0C7h7XAqSqrfXwWIhDDYEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABUPsnoPsQBmf0uN5xQxsOYWJXZaDNmZfocSiMDLyQ/iAAAAAAOgAAAAAIAACAAAAA42RG+RF36XUzaDyBe1rGGWHDkQaYLBO8YO80rTW3ejjAAAAAWdbFGwBMIO8VJlmzUniG/SbuZBSd9WrqH3nPj5aY3uHGpyfHVx1gr/oz7Z8UqMypAAAAA4Vf1GYQuUbxbvWrwAqDCyfKzgkYBxgvTzcCQES9TWZniIT2/7ms7ayEVqHXecaOUSoQPkws5EXkT/cS5VKVyuQ=="},"uninstall_metrics":{"installation_date2":"1721331556"},"user_experience_metrics":{"client_id2":"{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}C:\\Users\\user0s:92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A","diagnostics":{"last_data_collection_level_on_launch":1},"low_entropy_source3":3221,"pseudo_low_entropy_source":3015,"reset_client_id_deterministic":true,"stability":{"browser_last_live_timestamp":"13365805156488690","stats_buildtime":"1695934310","stats_version":"117.0.2045.47-64","system_crash_count":0}}}

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\2b4095ab-4f29-44c9-a5b6-55d5ecbfdb0d.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2900
                                                                                                                                                              Entropy (8bit):5.316948878661709
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:YDEFMsFiHGS0af5aJsAXV3p8QSh/cIgwLURMYXylVotoW535K1DztHB+0zdrxiBf:PNkGS1f5gsq58rh/cI9URoDotosGBpsB
                                                                                                                                                              MD5:2E5FFD258ED96F8546BFD5DCA25E5597
                                                                                                                                                              SHA1:0108E6957DFDED50F1A522D9F320353E83921F6F
                                                                                                                                                              SHA-256:40391DFEAC470E91EB8666EE6F2F1FB1395EC28F8F1A4704BF2BB47C0FC5CA1A
                                                                                                                                                              SHA-512:D108E8A6EF1462D571F4D151A11C3145F16160CB5E6FDB0C131F82303D79A2CE579E5BB6C4FCA8AEC4B5AACA753C882A2F2EC6F16D044B908FC007152BC2D2F6
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fre":{"oem_bookmarks_set":true},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAG0C7h7XAqSqrfXwWIhDDYEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABUPsnoPsQBmf0uN5xQxsOYWJXZaDNmZfocSiMDLyQ/iAAAAAAOgAAAAAIAACAAAAA42RG+RF36XUzaDyBe1rGGWHDkQaYLBO8YO80rTW3ejjAAAAAWdbFGwBMIO8VJlmzUniG/SbuZBSd9WrqH3nPj5aY3uHGpyfHVx1gr/oz7Z8UqMypAAAAA4Vf1GYQuUbxbvWrwAqDCyfKzgkYBxgvTzcCQES9TWZniIT2/7ms7ayEVqHXecaOUSoQPkws5EXkT/cS5VKVyuQ=="},"policy":{"last_statistics_update":"13365805156823660"},"profile":{"info_cache":{"Default":{"avatar_icon":"chrome://t

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\BrowserMetrics\BrowserMetrics-66996F64-D04.pma

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1310720
                                                                                                                                                              Entropy (8bit):0.6661869216131276
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:9f3bpE3IPHf4x/CRGg1DRFFGRGQY2z7oDqy3hW6dbACONRG:FrpE2/4x/rg1HFP2z0Dqx6FJ
                                                                                                                                                              MD5:2BC6213B7E4CA0B7EC5542ACFAC7C0E2
                                                                                                                                                              SHA1:0AB6810162A4EAD8C88240038308BA0DE9D6B9AA
                                                                                                                                                              SHA-256:ACC6D9B623CE2E783718DB58288F7D8AD88E7E44250D0B8C5C03D65C48B9358A
                                                                                                                                                              SHA-512:5DADF2939EA036DB8DED01B6C752CF399C9B27AD1340897313223A6D5B0FA66E9B64E69451D17FD1F7DEA73FB76048E014B76C4471B4B160B5D9620874CB6EB2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:...@............C.].....@...................................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....6.........117.0.2045.47-64".en-GB*...Windows NT..10.0.190452(..x86_64..?........".smofar20,1...x86_64J....?.^o..P......................>..*......hW:00000000000000000000000000000000000000000000!00000000000000000000000000000000000000000000!BitComet.exe. 1900/01/01:00:00:00!BitComet.exe".2.082...".*.:...............,..(.......EarlyProcessSingleton.......Default3.(..$.......msEdgeEDropUI.......triggered....8..4... ...msDelayLoadAuthenticationManager....triggered....<..8...#...msSleepingTabsShorterTimeoutDefault.....triggered....8..4... ...msEdgeMouseGestureDefaultEnabled....triggered....8..4.......msEdgeShowHomeButtonByDefault.......triggered....<..8...$...msConsumerIEModeToolbarButtonDef

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Crashpad\settings.dat

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):280
                                                                                                                                                              Entropy (8bit):1.8873942837026083
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:FiWWltlwGLll1NEjYb1gmlx/ll:o1wGpfCmlZl
                                                                                                                                                              MD5:082D8883B91981686E1E7DD2F5AC0B90
                                                                                                                                                              SHA1:F0A1A0B998A71C60F07CE609727F3B5C14206B6C
                                                                                                                                                              SHA-256:4D3A99B181D33D21AF0E1F507D4EFE61298BA65243EB41065E660E4E6F0847DC
                                                                                                                                                              SHA-512:DE5CF0A660231AA9F54969C94FA78EC62D3D10733E68BED702E87FCC799586FA8F41301209E05225C405FCBB8E87CEE5A8C6EFBA07BD8E20E20FB58D31D1B99E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:sdPC......................@..{D.Up..(x.................................................................................................................................................................................................{F3017226-FE2A-4295-8BDF-00C3A9A7E4C.}C:........

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Crashpad\throttle_store.dat

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):20
                                                                                                                                                              Entropy (8bit):3.6219280948873624
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:8g6Vvn:8g6Vv
                                                                                                                                                              MD5:9E4E94633B73F4A7680240A0FFD6CD2C
                                                                                                                                                              SHA1:E68E02453CE22736169A56FDB59043D33668368F
                                                                                                                                                              SHA-256:41C91A9C93D76295746A149DCE7EBB3B9EE2CB551D84365FFF108E59A61CC304
                                                                                                                                                              SHA-512:193011A756B2368956C71A9A3AE8BC9537D99F52218F124B2E64545EEB5227861D372639052B74D0DD956CB33CA72A9107E069F1EF332B9645044849D14AF337
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:level=none expiry=0.

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\7c1a9ece-76f4-45c2-b82c-ae2ccb966c17.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):6780
                                                                                                                                                              Entropy (8bit):5.580009976132893
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:vKi+Plf/ROoBpkF5d19iu7VaTEv9V5h5pg5vezodIU8SefSpsA5IOrMn3YPo0MGP:/irZ+9l5vSpFIOAn3go0iuT
                                                                                                                                                              MD5:1D5D2358B94F72F9A81D807E064E0180
                                                                                                                                                              SHA1:9F8ECC1D9C7B00D7516218E8C7BE65A1BF423EDD
                                                                                                                                                              SHA-256:A4125797F294634E0CB6A95E862354B871957A2A1090167E5A67DB52083B7379
                                                                                                                                                              SHA-512:8EA353B130B1D74124D202481DEFEA40D0C9E180A55F622C8FF56FE4BB347F47E152A3BA8F0B770F6133C3F7D2684C533FE09FEAC761847D93F6C2DBFF74E7E1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:{"extensions":{"settings":{"dgiklkfkllikcanfonkcabmbdfmgleag":{"active_permissions":{"api":[],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13365805156935535","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13365805156935535","location":5,"manifest":{"content_capabilities":{"include_globs":["https://*excel.officeapps.live.com/*","https://*onenote.officeapps.live.com/*","https://*powerpoint.officeapps.live.com/*","https://*word-edit.officeapps.live.com/*","https://*excel.officeapps.live.com.mcas.ms/*","https://*onenote.officeapps.live.com.mcas.ms/*","https://*word-edit.officeapps.live.com.mcas.ms/*","https://*excel.partner.officewebapps.cn/*","https://*onenote.partner.officewebapps.cn/*","https://*powerpoint.partner.officewebapps.cn/*","https://*word-edit.partner.officewebapps.cn/*","https://*excel.gov.online.office365.us/*","

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\8580460a-c8fb-48f7-b76d-1d22be3e39f4.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):6006
                                                                                                                                                              Entropy (8bit):4.8157557310420165
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:stR/e6s13Gb9qG8zU85eh6Cb7/x+6MhmuecD61eAeEsE2MR7K:stF7sjGkU88bV+Fv6QAwEPhK
                                                                                                                                                              MD5:5C8E4EBC80BFF654064425F29D0A3629
                                                                                                                                                              SHA1:D13CA2058365275EAEEC1429E5610F006F6D4F35
                                                                                                                                                              SHA-256:B3468AD526A91D610BFE0C235E961FEBF6FD4FB812CFEC088ED9E2B2D6106A99
                                                                                                                                                              SHA-512:58F85A4B70DB4272EAE65C2C0767621C69559A4C2D48A020377BDB907786009731210C0D52B9FEF7E2B74FD15FCC41378154FE875C80699E7FEC8D4899BF6B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13365805158137310","alternate_error_pages":{"backup":true,"enabled":false},"autocomplete":{"retention_policy_last_version":117},"autofill":{"autostuff_enabled":false,"credit_card_enabled":false,"custom_data_enabled":false,"custom_data_fill_enabled":false,"custom_data_identify_info_from_form_enabled":false,"custom_data_save_enabled":false},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"browser_content_container_height":140,"browser_content_container_width":407,"browser_content_container_x":0,"browser_content_container_y":0,"countryid_at_install":17224,"credentials_enable_service":false,"dips_timer_last_update":"13365805158055870","domain_diversity":{"last_reporting_timestamp":"13365805158136480"},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\AssistanceHome\AssistanceHomeSQLite

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):12288
                                                                                                                                                              Entropy (8bit):0.3202460253800455
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
                                                                                                                                                              MD5:40B18EC43DB334E7B3F6295C7626F28D
                                                                                                                                                              SHA1:0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
                                                                                                                                                              SHA-256:85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
                                                                                                                                                              SHA-512:8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Cache\Cache_Data\data_0

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45056
                                                                                                                                                              Entropy (8bit):0.06676677105834336
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:/FC3+ci+sNQwNbBX3mE9MGReiFxRiehjFv+igE8DjinLvsowTay:dFQ4bBX31blrWE8Gt
                                                                                                                                                              MD5:7BFB155A866C897D1FC6592C983BF277
                                                                                                                                                              SHA1:6C9C6C692DB6CDA82D5E6AD9F959DE2CD90085C6
                                                                                                                                                              SHA-256:E25531EF1FA9986747C695C1095D0EDC6B7342E604A87D7F6D5F1C92F4A87D90
                                                                                                                                                              SHA-512:55C84A1023842863CC9E036B7FEAB2DF71B0998292C62752FAA1044FF82C453D4F38F1BDBA98750E52CB8C7354F8BE222AC1D7E05679F38EBD07197385C0F4C9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Cache\Cache_Data\data_1

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):270336
                                                                                                                                                              Entropy (8bit):0.05360585183945391
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:U/ZgXaTFkG5UJW7KkhEUGmL0RDQ4C76UAhg27kXpi7PlcN0I7U0FmXQI7MlWWmXo:tmFVUJW9FSFxZHaOlSU0FSQvlWWrP
                                                                                                                                                              MD5:2A0DDE5E61ABD01F71B819B1031CBEA1
                                                                                                                                                              SHA1:19887E8AF60A209D4315CC5956B70863A63E33B4
                                                                                                                                                              SHA-256:B59BE78BCFEA5B30F4125A01C58D486FFC261B78B03D73B7020FA05CDEAFC19E
                                                                                                                                                              SHA-512:7685DF7EC0086D46D6245FD5D87BD6D52BC4B4BDD2000B59E189FC1BC2CBA39924FFE352C615D599E18EB1A8565E78041152B5F721082973088D99C2CCB8B6AD
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Cache\Cache_Data\data_2

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1056768
                                                                                                                                                              Entropy (8bit):0.38940456317337224
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:yrtJt69XNJt8XNJtB6PXNJtLdOFlVnz8GXNJtoXNJtjXNJt:yg9XWXf6PX5dOFlVnz8GXSXxX
                                                                                                                                                              MD5:04D8780061314808F7425282DB6B059F
                                                                                                                                                              SHA1:32BBF8EFA0BD2B739E764D2B0293E10B0CA95B31
                                                                                                                                                              SHA-256:CB5E19D5D4F74B51364685E0A95F7C25ADFF1282B7D7CC03B64C76A093252D41
                                                                                                                                                              SHA-512:CE58F89E8BA68451A57E22945FC4560E9459AFB49EE67CDA0BB84C20E1B3BE62DDC7449A16E769F6717187C1724A81C35C4F880B28573E2E9BC9E357DD440FBE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:................................................................................?.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Cache\Cache_Data\data_3

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4202496
                                                                                                                                                              Entropy (8bit):0.033218655604129115
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:csQh+erPWuiuTK4JZbtM6+JP+AREUc19dn:5Qh+6PWuiCJth+JPnEUc19N
                                                                                                                                                              MD5:2ADE40A4A9AEF9ADD34A2EC25AB45D6E
                                                                                                                                                              SHA1:77DB8A93861101FA4F4830382921E3F739794E44
                                                                                                                                                              SHA-256:4D80A131A26AEE166A4CBB7351810AA4F634F5B164F384B777C20D816F87FB05
                                                                                                                                                              SHA-512:3ACFFBA3C7B3A65650D845D7256E79E36100BC80F8C7686541CF2B12F259CA5029F486D9ABB125A19D8F6CE704323661D792C49D4455A45E00CC83D5A2DC1ADE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Cache\Cache_Data\f_000001

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:ASCII text, with very long lines (5945)
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):312444
                                                                                                                                                              Entropy (8bit):5.56721463135677
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6144:54PFp2L/QlIzo5J+DL9S/Hu0bwJQNQntrhiiXi3QE:yPatkJItVE/
                                                                                                                                                              MD5:35692FC7993A57F89FAFAA649F296FB7
                                                                                                                                                              SHA1:1488A785F2640607E52541C60170B457C3A87A6B
                                                                                                                                                              SHA-256:5D2F77833BB6529A4E5196A86E1F5843D6F5458FB0EAA18168B05827B717CEAF
                                                                                                                                                              SHA-512:07405D40A5FD171CE44E9D7FB41334D49A1C121959E1E454ABB87ADD94476DDD67150E6CBCF1641AF77AA2B51E39D61981E8C40D0D3FB5BFA91D9B4BB478D44E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[{"function":"__e"},{"vtp_signal":0,"function":"__c","vtp_value":0},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0},{"vtp_signal":0,"function":"__c","vtp_value":0},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_1p_data_v2","priority":14,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp_streetType":"CSS_SELECTOR","vtp_autoPhoneEnabled":false,"vtp_postalCodeType":"CSS_SELECTOR","vtp_email

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Cache\Cache_Data\f_000002

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:ASCII text, with very long lines (33048)
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):164401
                                                                                                                                                              Entropy (8bit):5.164050548400874
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:dSp1Fp/FVgpe1hcfPK1GOGKiVNya46SeaJNJ8rQl:dSwYuTOBiVN1SeaJNB
                                                                                                                                                              MD5:2B54E082BDD07E232FBAC36072B50FA4
                                                                                                                                                              SHA1:2F57DBCA655826449648651A6AEE8FA4E422A03C
                                                                                                                                                              SHA-256:8248168E050B5D1FEE4EAA6D57149DDCADC312A95AD4246125F5EBB545A0F779
                                                                                                                                                              SHA-512:7BC8FF18D2B4A6B4467C49D98BE1E661ED766C679B68488EC209F736B3953DCBF3979E1417753450F329685ABC3AC94249E71DFD0E9DF92A469A28FA02C4D766
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:@charset "UTF-8";.materialize-red{background-color:#e51c23!important}.materialize-red-text{color:#e51c23!important}.materialize-red.lighten-5{background-color:#fdeaeb!important}.materialize-red-text.text-lighten-5{color:#fdeaeb!important}.materialize-red.lighten-4,.materialize-red.p_main_container{background-color:#f8c1c3!important}.materialize-red-text.text-lighten-4{color:#f8c1c3!important}.materialize-red.lighten-3,.p_article .materialize-red.p_alternative{background-color:#f3989b!important}.materialize-red-text.text-lighten-3{color:#f3989b!important}.materialize-red.lighten-2{background-color:#ee6e73!important}.materialize-red-text.text-lighten-2{color:#ee6e73!important}.materialize-red.lighten-1{background-color:#ea454b!important}.materialize-red-text.text-lighten-1{color:#ea454b!important}.materialize-red.darken-1{background-color:#d0181e!important}.materialize-red-text.text-darken-1,.p_footer a.materialize-red-text:hover,.p_footer a.materialize-red-text:link,.p_footer a.material

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Cache\Cache_Data\f_000003

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:PNG image data, 454 x 454, 8-bit/color RGBA, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):56904
                                                                                                                                                              Entropy (8bit):7.984452226174247
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:tNTJTLegShtw7mk87tYZaV70DzFTr+O4TeMH:DJuzhy7mk8ZYo2z9CDH
                                                                                                                                                              MD5:9CC1FE1B3A24AB7F3D670CB666A06941
                                                                                                                                                              SHA1:498F35F90C0245885B369F7F6772BB34703420EB
                                                                                                                                                              SHA-256:D810B7149DB98D232565C88A9C490581D03B54D6D7A9951BBA3EE070A8AAECE5
                                                                                                                                                              SHA-512:5BD86C35AB13F43A3498D074671DE1CFB9C2F33E7FFAD678D005A67FB79AF71713E9EA9E734DFABD93D2C7D117956863A55CB30EE0981E51CB932FC36FF4D73B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR..............b+)....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:633EA2EA241811E7A4C59DF0C3164ABD" xmpMM:DocumentID="xmp.did:633EA2EB241811E7A4C59DF0C3164ABD"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:633EA2E8241811E7A4C59DF0C3164ABD" stRef:documentID="xmp.did:633EA2E9241811E7A4C59DF0C3164ABD"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.[....IDATx...|$.u'..g.9/."-..Fn`NbZ.b.IQ9.l9}r..Qg..l..e...|...}..E.DQ")..)......r..6!......AwO.....jY.0.Cu....E

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Cache\Cache_Data\index

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):524656
                                                                                                                                                              Entropy (8bit):5.027445846313988E-4
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:LsulEhXll:Ls
                                                                                                                                                              MD5:EA7C0E26D5D9AB1B6B67453991742F50
                                                                                                                                                              SHA1:7DF0FD3D086E58A9B87F22ED7C36723593984822
                                                                                                                                                              SHA-256:B71248C729AF7E5B8BFE0F47CE1B2CFB800ACA40B356E3CD57490A237B2FF042
                                                                                                                                                              SHA-512:5F5EAB9A61F157528FA5793ABF0CFFB92ED6620F66EC6950A467A4384292FA4CF3DAC05388E35E4C12E80C7D3DA8458BD222D4E33794307112A5025CD48841B2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:........................................G]..!|/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Code Cache\js\eb80c3150bc6e9de_0

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):262
                                                                                                                                                              Entropy (8bit):5.607887106781262
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:mutbYygIYlbCwt2H6tip59P2lnE+gY4P:5tVP6wp5tN1
                                                                                                                                                              MD5:0C98995B6DD2A91794BFEAE034704ADB
                                                                                                                                                              SHA1:F16AE69BB0070BDF8D71AD18BCF6C04D3E4944B1
                                                                                                                                                              SHA-256:6E8B1B4A08D1654FB8C03DC5F0C5C57DDACD753464D3A976D3CD0F02587D666F
                                                                                                                                                              SHA-512:802C308A381DC7E3428E033F11296DFFAF49814A1B8A5689C13736DB409BB01C402F23C599CD880D7EF8E6BD37427741A0909F7863E7C955F622437120FE94A2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:0\r..m......R...{.D....._keyhttps://appassets.bitcomet.com/assets/index-710fe85a.js .https://bitcomet.com/.A..Eo......................!|/.@............a....i.H.j...T'.....KW.{..c9.....Z............Lf.......5%z.o....3%...)6et...o...PT....A..Eo..........L.......

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Code Cache\js\index

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):24
                                                                                                                                                              Entropy (8bit):2.1431558784658327
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:m+l:m
                                                                                                                                                              MD5:54CB446F628B2EA4A5BCE5769910512E
                                                                                                                                                              SHA1:C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
                                                                                                                                                              SHA-256:FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
                                                                                                                                                              SHA-512:8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:0\r..m..................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Code Cache\js\index-dir\temp-index

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):72
                                                                                                                                                              Entropy (8bit):3.687218230578928
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:A2zyR0Xl/ldldlxw7olHl7aB0l:A2Jxw7KM0l
                                                                                                                                                              MD5:06C4D09A80DCF7ED7F5A4F64485ABE04
                                                                                                                                                              SHA1:3A7E4807DB0C332E251C3FFEE9D54E7C238E6390
                                                                                                                                                              SHA-256:AD43747FE0A58453FE9E0D8E479FE5F2603404FEAB65A9BF61050D821524D07C
                                                                                                                                                              SHA-512:EE5FF583E046B26DCC105ADFF41CBAB5467F206FF88882C94B15EF0EF2AD6EF459B795EC2AFC33FC28AE958EF79E5BD5E06A3A43931CDFE7509E4F4E9308FAE9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:@....>w.oy retne...............................@><.!|/.........}#?.!|/.

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Code Cache\js\index-dir\the-real-index (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):72
                                                                                                                                                              Entropy (8bit):3.687218230578928
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:A2zyR0Xl/ldldlxw7olHl7aB0l:A2Jxw7KM0l
                                                                                                                                                              MD5:06C4D09A80DCF7ED7F5A4F64485ABE04
                                                                                                                                                              SHA1:3A7E4807DB0C332E251C3FFEE9D54E7C238E6390
                                                                                                                                                              SHA-256:AD43747FE0A58453FE9E0D8E479FE5F2603404FEAB65A9BF61050D821524D07C
                                                                                                                                                              SHA-512:EE5FF583E046B26DCC105ADFF41CBAB5467F206FF88882C94B15EF0EF2AD6EF459B795EC2AFC33FC28AE958EF79E5BD5E06A3A43931CDFE7509E4F4E9308FAE9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:@....>w.oy retne...............................@><.!|/.........}#?.!|/.

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RF6699fd.TMP (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):72
                                                                                                                                                              Entropy (8bit):3.687218230578928
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:A2zyR0Xl/ldldlxw7olHl7aB0l:A2Jxw7KM0l
                                                                                                                                                              MD5:06C4D09A80DCF7ED7F5A4F64485ABE04
                                                                                                                                                              SHA1:3A7E4807DB0C332E251C3FFEE9D54E7C238E6390
                                                                                                                                                              SHA-256:AD43747FE0A58453FE9E0D8E479FE5F2603404FEAB65A9BF61050D821524D07C
                                                                                                                                                              SHA-512:EE5FF583E046B26DCC105ADFF41CBAB5467F206FF88882C94B15EF0EF2AD6EF459B795EC2AFC33FC28AE958EF79E5BD5E06A3A43931CDFE7509E4F4E9308FAE9
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:@....>w.oy retne...............................@><.!|/.........}#?.!|/.

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Code Cache\wasm\index

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):24
                                                                                                                                                              Entropy (8bit):2.1431558784658327
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:m+l:m
                                                                                                                                                              MD5:54CB446F628B2EA4A5BCE5769910512E
                                                                                                                                                              SHA1:C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
                                                                                                                                                              SHA-256:FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
                                                                                                                                                              SHA-512:8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:0\r..m..................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Code Cache\wasm\index-dir\temp-index

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):48
                                                                                                                                                              Entropy (8bit):2.9972243200613975
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:nHSryyEruj:yrqruj
                                                                                                                                                              MD5:4B921FE855398CFCF291B78821097075
                                                                                                                                                              SHA1:9F237557F48F05E764D2778641068796B5AFBACA
                                                                                                                                                              SHA-256:DA2B6A821440CEDBB4A7865A38828AD10A6CDB2492E8254DF44C3E59DF523249
                                                                                                                                                              SHA-512:1A8767DC56ACC238BD61E97D63B6F986E5A2AD6FA848FC7332CC7A3CC6AA901AA01A9C2CD14111297E0AF45122BECF745AD9828339D04120A46CD34F1DA6BFD2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:(...."7.oy retne.........................E..!|/.

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):48
                                                                                                                                                              Entropy (8bit):2.9972243200613975
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:nHSryyEruj:yrqruj
                                                                                                                                                              MD5:4B921FE855398CFCF291B78821097075
                                                                                                                                                              SHA1:9F237557F48F05E764D2778641068796B5AFBACA
                                                                                                                                                              SHA-256:DA2B6A821440CEDBB4A7865A38828AD10A6CDB2492E8254DF44C3E59DF523249
                                                                                                                                                              SHA-512:1A8767DC56ACC238BD61E97D63B6F986E5A2AD6FA848FC7332CC7A3CC6AA901AA01A9C2CD14111297E0AF45122BECF745AD9828339D04120A46CD34F1DA6BFD2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:(...."7.oy retne.........................E..!|/.

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\DIPS

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):28672
                                                                                                                                                              Entropy (8bit):0.4861127065051833
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBphQ:TouQq3qh7z3bY2LNW9WMcUvB
                                                                                                                                                              MD5:1AC7B83C55DB27E884B020236B2F100E
                                                                                                                                                              SHA1:5C3676E71CC720899C56CFE10ED0B5257649741E
                                                                                                                                                              SHA-256:4A774CEC78B7F93D626831139FC2F7DF3F4949769773F6F2ACFC9E16F41B09A2
                                                                                                                                                              SHA-512:FE8FEC323579C68DCAAE26F4FFDD27DDCB88706A55B4150A377017635067BF87C73D9646E826AF7FD4EA81258585F1B203189997FB9C16FC33E7CB7560040197
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\DawnCache\data_0

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.01057775872642915
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:MsFl:/F
                                                                                                                                                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\DawnCache\data_1

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):270336
                                                                                                                                                              Entropy (8bit):8.280239615765425E-4
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:MsEllllkEthXllkl2:/M/xT02
                                                                                                                                                              MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                              SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                              SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                              SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\DawnCache\data_2

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.011852361981932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:MsHlDll:/H
                                                                                                                                                              MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\DawnCache\data_3

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.012340643231932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:MsGl3ll:/y
                                                                                                                                                              MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\DawnCache\index

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):262512
                                                                                                                                                              Entropy (8bit):9.47693366977411E-4
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:LsNlX8l:Ls3
                                                                                                                                                              MD5:453127668215FB4483024F9E273D69CC
                                                                                                                                                              SHA1:7254EE4A1A5EB0C3C945A3E1049AE524360717B1
                                                                                                                                                              SHA-256:928736BF8209A03ED2AB0D16542864680D9DFDF25DD9A3ADFA5A1CC6BF500F1A
                                                                                                                                                              SHA-512:1EAE86B9E35F30BE67EBF4E17102703FBC7B748EE87A4B9C7899B1FB9464882F7322A3C58350D83F6276B363B605F28001B25410B1AF27A409AE335F885A3A78
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:...........................................!|/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\EdgeEDrop\EdgeEDropSQLite.db

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):32768
                                                                                                                                                              Entropy (8bit):0.494709561094235
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
                                                                                                                                                              MD5:CF7760533536E2AF66EA68BC3561B74D
                                                                                                                                                              SHA1:E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
                                                                                                                                                              SHA-256:E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
                                                                                                                                                              SHA-512:38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Extension Rules\000001.dbtmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Extension Rules\000003.log

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):38
                                                                                                                                                              Entropy (8bit):1.8784775129881184
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:FQxlXNQxlX:qTCT
                                                                                                                                                              MD5:51A2CBB807F5085530DEC18E45CB8569
                                                                                                                                                              SHA1:7AD88CD3DE5844C7FC269C4500228A630016AB5B
                                                                                                                                                              SHA-256:1C43A1BDA1E458863C46DFAE7FB43BFB3E27802169F37320399B1DD799A819AC
                                                                                                                                                              SHA-512:B643A8FA75EDA90C89AB98F79D4D022BB81F1F62F50ED4E5440F487F22D1163671EC3AE73C4742C11830214173FF2935C785018318F4A4CAD413AE4EEEF985DF
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.f.5................f.5...............

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Extension Rules\CURRENT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Extension Rules\LOG

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):267
                                                                                                                                                              Entropy (8bit):5.313498591396506
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:BQPY81wkn23NLdpaVdg2KLlrQPust+q2Pwkn23NLdpaPrqIFUv:qYfXHLSuNvYfXo3FUv
                                                                                                                                                              MD5:56B96E31B2557FFE13FA48A34ED43181
                                                                                                                                                              SHA1:09074F2C143FADAA118BC8076CA50C5ACE2F00A3
                                                                                                                                                              SHA-256:83F1F0A72C4AB82CC8296FDA46C96A69C0E46F0B86058110E6686C2CB0999BCE
                                                                                                                                                              SHA-512:49B206F675D2CA6BF9FC152DF854C09240A012F9C3859E989B70F96D9EA9642146D8AB1D2F0E9DD7149689CD56DC196184DED8E345DCD06BB4A77C47D32BD3AE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2024/07/18-15:39:17.306 a68 Creating DB C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Extension Rules since it was missing..2024/07/18-15:39:17.555 a68 Reusing MANIFEST C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Extension Rules/MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Extension Rules\MANIFEST-000001

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41
                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Extension Scripts\000001.dbtmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Extension Scripts\000003.log

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):38
                                                                                                                                                              Entropy (8bit):1.8784775129881184
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:FQxlXNQxlX:qTCT
                                                                                                                                                              MD5:51A2CBB807F5085530DEC18E45CB8569
                                                                                                                                                              SHA1:7AD88CD3DE5844C7FC269C4500228A630016AB5B
                                                                                                                                                              SHA-256:1C43A1BDA1E458863C46DFAE7FB43BFB3E27802169F37320399B1DD799A819AC
                                                                                                                                                              SHA-512:B643A8FA75EDA90C89AB98F79D4D022BB81F1F62F50ED4E5440F487F22D1163671EC3AE73C4742C11830214173FF2935C785018318F4A4CAD413AE4EEEF985DF
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.f.5................f.5...............

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Extension Scripts\CURRENT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Extension Scripts\LOG

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):271
                                                                                                                                                              Entropy (8bit):5.303361535006303
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:BQPJE/1wkn23NLdp6FB2KLlrQPSN+q2Pwkn23NLdp65IFUv:qJFfXQFFLSzvYfXQWFUv
                                                                                                                                                              MD5:F7CD00521400D755DE01DD783FFFAEF3
                                                                                                                                                              SHA1:72E20D875B70AA5872C2434075BD976F062DD388
                                                                                                                                                              SHA-256:C249E9ACDD57141BCA5A986DB50E31726CF256EE83065FB1C4B36F2C8F5F88A6
                                                                                                                                                              SHA-512:EED98A84F9CE966528667E52BD9B28148D9DA67A423F396FF2CFD533671A1373272C709C58F8FC4013BAE9191A13058DC87EB78825B50A653939B6AA338832AE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2024/07/18-15:39:17.723 a68 Creating DB C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Extension Scripts since it was missing..2024/07/18-15:39:17.772 a68 Reusing MANIFEST C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Extension Scripts/MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Extension Scripts\MANIFEST-000001

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41
                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Extension State\000001.dbtmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Extension State\000003.log

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):114
                                                                                                                                                              Entropy (8bit):1.8784775129881184
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCT
                                                                                                                                                              MD5:891A884B9FA2BFF4519F5F56D2A25D62
                                                                                                                                                              SHA1:B54A3C12EE78510CB269FB1D863047DD8F571DEA
                                                                                                                                                              SHA-256:E2610960C3757D1757F206C7B84378EFA22D86DCF161A98096A5F0E56E1A367E
                                                                                                                                                              SHA-512:CD50C3EE4DFB9C4EC051B20DD1E148A5015457EE0C1A29FFF482E62291B32097B07A069DB62951B32F209FD118FD77A46B8E8CC92DA3EAAE6110735D126A90EE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.f.5................f.5................f.5................f.5................f.5................f.5...............

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Extension State\CURRENT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Extension State\LOG

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):269
                                                                                                                                                              Entropy (8bit):5.285840516129569
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:BQe4s1wkn23NLdpYg2KLlrQ9OOq2Pwkn23NLdpNIFUv:gLfXNLXOvYfXwFUv
                                                                                                                                                              MD5:0A425860FBB70B515674F86D4676E429
                                                                                                                                                              SHA1:359C1F5F3847E8C780F6BDEF4B8161FE6BB921B5
                                                                                                                                                              SHA-256:CCD7B5A90FEFE94BE418F1E6397A081D2944DEFEE548ABF94FB9B99536848753
                                                                                                                                                              SHA-512:293AADA6ED8294AD15C105D10D126C6AE211DA3F97F5D4C0057972A24C4554B0352C7D4EFD6C9CB4912D3B43CFF0B8E0D62CD3573418E49CFFF6BBF6593238A8
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2024/07/18-15:39:18.488 16c0 Creating DB C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Extension State since it was missing..2024/07/18-15:39:18.547 16c0 Reusing MANIFEST C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Extension State/MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Extension State\MANIFEST-000001

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41
                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\ExtensionActivityComp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):0.3169096321222068
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
                                                                                                                                                              MD5:2554AD7847B0D04963FDAE908DB81074
                                                                                                                                                              SHA1:F84ABD8D05D7B0DFB693485614ECF5204989B74A
                                                                                                                                                              SHA-256:F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
                                                                                                                                                              SHA-512:13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\ExtensionActivityEdge

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):32768
                                                                                                                                                              Entropy (8bit):0.40981274649195937
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
                                                                                                                                                              MD5:1A7F642FD4F71A656BE75B26B2D9ED79
                                                                                                                                                              SHA1:51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
                                                                                                                                                              SHA-256:B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
                                                                                                                                                              SHA-512:FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Favicons

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 11, cookie 0x8, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):22528
                                                                                                                                                              Entropy (8bit):2.261537399051776
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:RBCyHOtKiFi3wh7GyoB68xbwa1n0XKpVEfi:nNyKisgh7Gz68xl1npVL
                                                                                                                                                              MD5:584FE829973AA68FC1CF5DC6C0424A48
                                                                                                                                                              SHA1:790933646D4A6DF2F7FD438919CDB6769598BE0C
                                                                                                                                                              SHA-256:3F261634F412C2AC89DA80FD69651F2563F8DE68E045E49868610C3E5A45BFF5
                                                                                                                                                              SHA-512:B24CE2868A95B8D27162FF4DEF404130E5349C1800BCC5D36DEB13D575910A8461A34A073ECF188D32D9B1C9A204ED7906B33CD3BF82A2BEAEC93A12950A51D0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\GPUCache\data_0

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.01057775872642915
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:MsFl:/F
                                                                                                                                                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\GPUCache\data_1

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):270336
                                                                                                                                                              Entropy (8bit):8.280239615765425E-4
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:MsEllllkEthXllkl2:/M/xT02
                                                                                                                                                              MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                              SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                              SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                              SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\GPUCache\data_2

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.011852361981932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:MsHlDll:/H
                                                                                                                                                              MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\GPUCache\data_3

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.012340643231932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:MsGl3ll:/y
                                                                                                                                                              MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\GPUCache\index

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):262512
                                                                                                                                                              Entropy (8bit):9.553120663130604E-4
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:LsNlull:Ls3
                                                                                                                                                              MD5:4B2006722E498716FEF6F598F8AEBED8
                                                                                                                                                              SHA1:0691B590FC69BA6C1FDC4EBB396E083195C6089E
                                                                                                                                                              SHA-256:21E5731FA86FF1EECC59811DA5991F3D4B3E46B5320BBD05C7AC9B5613F41C3D
                                                                                                                                                              SHA-512:298C06028ABB4FA93D4F08FBD83850AED98E347C868F924CD582B44711BB10713F8BE5CE5A79C7F86B4EA83BF456DCCE0F2401FC3FA6FEA6F6CB54CB050BF692
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:........................................f...!|/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\History

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):155648
                                                                                                                                                              Entropy (8bit):0.6250853006563456
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:+yzm+gqrhhH+bDo3iN0Dm2TVJkXBBE3ybP4:+mp7hhIU3iGD1IBBE3qP4
                                                                                                                                                              MD5:C89E31323EA57138B83D84D974C319E5
                                                                                                                                                              SHA1:84ED5BC50F268233927121B32C53B5C37314AFAD
                                                                                                                                                              SHA-256:A93F73AEDEE3ED44511F65342D3AE920497E86FC9CEE67DCBB19F0E94AD6A6FC
                                                                                                                                                              SHA-512:438AE5A8F4FFF82CBE7CED9EC110325AB96E3FBA70F026145062E9E913AA7B35950A923CC31FFD96CCAC0560CA1ABBCF898CD572A263C5F3A37210E671DDB28C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Local Storage\leveldb\000001.dbtmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Local Storage\leveldb\CURRENT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Local Storage\leveldb\LOG

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):281
                                                                                                                                                              Entropy (8bit):5.334600189437199
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:BQBtUUB1wkn23NLd1a2jM8B2KLlrQB/39+q2Pwkn23NLd1a2jMGIFUv:OkfX1jFLQIvYfX1EFUv
                                                                                                                                                              MD5:B8A483CC5D6BCA0F7D20C5F050A043FA
                                                                                                                                                              SHA1:6050AF3EA8653C468EF92E58AF81FBC64C9BFE47
                                                                                                                                                              SHA-256:9FDE809DE3508B25F7F0E02E59A14D37CA93AB5CA0474F667D6E1EA0EA3885D3
                                                                                                                                                              SHA-512:D9CE931D6A674129A5975C3B0F017C452E77A3BD41D3D89B4CB63010AE6A89AF8F677D8D3B1B7B745FC84D5FE0FB6811EFAF6779A02D0BAB89EA52CB7B572583
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2024/07/18-15:39:19.561 1ad8 Creating DB C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Local Storage\leveldb since it was missing..2024/07/18-15:39:19.695 1ad8 Reusing MANIFEST C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Local Storage\leveldb/MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Local Storage\leveldb\MANIFEST-000001

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41
                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Login Data

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 21, cookie 0xc, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):43008
                                                                                                                                                              Entropy (8bit):0.9009435143901008
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:C2BeymwLCn8MouB6wzFlXqiEqUvJKLuyn:C2TLG7IwRFqidn
                                                                                                                                                              MD5:FB3D677576C25FF04A308A1F627410B7
                                                                                                                                                              SHA1:97D530911F9CB0C37717ABB145D748982ADA0440
                                                                                                                                                              SHA-256:A79300470D18AF26E3C5B4F23F81915B92D490105CE84A8122BF8100EC0C7517
                                                                                                                                                              SHA-512:ED6666B064958B107E55BD76E52D2E5BF7A4791379902D208EF909A6B68803240D372CE03641249EB917C241B36A5684656A48D099A8A084AD34BA009857B098
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Network Action Predictor

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):45056
                                                                                                                                                              Entropy (8bit):0.4486984123294751
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:Tmo9n+8dv/qALihje9kqL42WOT/9Fc2c:L9n+8d3qAuhjspnWOvG
                                                                                                                                                              MD5:7AFBAB625063B9FB9683B86062CACD61
                                                                                                                                                              SHA1:574609F718D9AD293666D9125A1BAFD5822647AE
                                                                                                                                                              SHA-256:5B0DEE2B4383E78BF756288846C92B44657F0DF7FD06C767DBD0803DF16129D4
                                                                                                                                                              SHA-512:255FCD18117009DA3913B06EAF18213FC8993C32B22E51B13C90ACFD4DF2B6ECFD3F30B1793EA35EFC6DAA85D299022FB228A1BF8E2E68B8F06B8E2EC31E6A2C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Network\Cookies

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):20480
                                                                                                                                                              Entropy (8bit):1.2562060014428378
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:TsKLopF+SawLUO1Xj8B5UQWPTACPdjwEqdTOi5+:te+Au5WPNCsq+
                                                                                                                                                              MD5:84362799E29108DBA687F605EDFEF594
                                                                                                                                                              SHA1:6ABA47F69621614787848506666EFB1B0BB69650
                                                                                                                                                              SHA-256:026F686CD03C43CBFE5C0118AD059E067E1FDD537AA11338FF3879574A0199EA
                                                                                                                                                              SHA-512:4ACA1ED12952EA3F9ED83DB22423478C1BC90B57456B1A41F2FB0C7A51B02959A3BE21587F1544BC991D751075FF1E269D17EF170FECD6A1FA7837478D88BF97
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Network\Network Persistent State (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):59
                                                                                                                                                              Entropy (8bit):4.619434150836742
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:YLbkVKJq0nMb1KKqk1Yn:YHkVKJTnMRKXk1Yn
                                                                                                                                                              MD5:78BFCECB05ED1904EDCE3B60CB5C7E62
                                                                                                                                                              SHA1:BF77A7461DE9D41D12AA88FBA056BA758793D9CE
                                                                                                                                                              SHA-256:C257F929CFF0E4380BF08D9F36F310753F7B1CCB5CB2AB811B52760DD8CB9572
                                                                                                                                                              SHA-512:2420DFF6EB853F5E1856CDAB99561A896EA0743FCFF3E04B37CB87EDDF063770608A30C6FFB0319E5D353B0132C5F8135B7082488E425666B2C22B753A6A4D73
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Network\Reporting and NEL

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):36864
                                                                                                                                                              Entropy (8bit):0.5559635235158827
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:OIEumQv8m1ccnvS6
                                                                                                                                                              MD5:9AAAE8C040B616D1378F3E0E17689A29
                                                                                                                                                              SHA1:F91E7DE07F1DA14D15D067E1F50C3B84A328DBB7
                                                                                                                                                              SHA-256:5B94D63C31AE795661F69B9D10E8BFD115584CD6FEF5FBB7AA483FDC6A66945B
                                                                                                                                                              SHA-512:436202AB8B6BB0318A30946108E6722DFF781F462EE05980C14F57F347EDDCF8119E236C3290B580CEF6902E1B59FB4F546D6BD69F62479805B39AB0F3308EC1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Network\SCT Auditing Pending Reports (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2
                                                                                                                                                              Entropy (8bit):1.0
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:H:H
                                                                                                                                                              MD5:D751713988987E9331980363E24189CE
                                                                                                                                                              SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                              SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                              SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:[]

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Network\SCT Auditing Pending Reports~RF662673.TMP (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2
                                                                                                                                                              Entropy (8bit):1.0
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:H:H
                                                                                                                                                              MD5:D751713988987E9331980363E24189CE
                                                                                                                                                              SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                              SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                              SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:[]

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Network\Sdch Dictionaries (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):40
                                                                                                                                                              Entropy (8bit):4.1275671571169275
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                                                                                                                              MD5:20D4B8FA017A12A108C87F540836E250
                                                                                                                                                              SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                                                                                                                              SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                                                                                                                              SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Network\Trust Tokens

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):36864
                                                                                                                                                              Entropy (8bit):0.36515621748816035
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
                                                                                                                                                              MD5:25363ADC3C9D98BAD1A33D0792405CBF
                                                                                                                                                              SHA1:D06E343087D86EF1A06F7479D81B26C90A60B5C3
                                                                                                                                                              SHA-256:6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
                                                                                                                                                              SHA-512:CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Network\c184586b-6aa1-427b-a023-b3025294d185.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):40
                                                                                                                                                              Entropy (8bit):4.1275671571169275
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                                                                                                                              MD5:20D4B8FA017A12A108C87F540836E250
                                                                                                                                                              SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                                                                                                                              SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                                                                                                                              SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Network\c5f924f1-a6e5-4b70-a8f7-d4eb289a4b08.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2
                                                                                                                                                              Entropy (8bit):1.0
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:H:H
                                                                                                                                                              MD5:D751713988987E9331980363E24189CE
                                                                                                                                                              SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                              SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                              SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:[]

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Network\dc0df643-d22d-4a50-b307-dc08d78fe507.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):59
                                                                                                                                                              Entropy (8bit):4.619434150836742
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:YLbkVKJq0nMb1KKqk1Yn:YHkVKJTnMRKXk1Yn
                                                                                                                                                              MD5:78BFCECB05ED1904EDCE3B60CB5C7E62
                                                                                                                                                              SHA1:BF77A7461DE9D41D12AA88FBA056BA758793D9CE
                                                                                                                                                              SHA-256:C257F929CFF0E4380BF08D9F36F310753F7B1CCB5CB2AB811B52760DD8CB9572
                                                                                                                                                              SHA-512:2420DFF6EB853F5E1856CDAB99561A896EA0743FCFF3E04B37CB87EDDF063770608A30C6FFB0319E5D353B0132C5F8135B7082488E425666B2C22B753A6A4D73
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Network\dfb5f34b-0ffb-49b7-90f6-99e1e65ce69a.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2
                                                                                                                                                              Entropy (8bit):1.0
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:H:H
                                                                                                                                                              MD5:D751713988987E9331980363E24189CE
                                                                                                                                                              SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                              SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                              SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:[]

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Preferences (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):5971
                                                                                                                                                              Entropy (8bit):4.816979185339521
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:stR/e6s13Gb9qG8zS85eh6Cb7/x+6MhmuecD61eAeEsE2MR7K:stF7sjGkS88bV+Fv6QAwEPhK
                                                                                                                                                              MD5:7224C47E36076D15C6413F60B252F1E4
                                                                                                                                                              SHA1:0706092AD2D4B760687B71F19B9DD2E0B6525FDE
                                                                                                                                                              SHA-256:36E4EB55E0523141FE37F69695090C43068A80ADF620E0DC3651731316DCA6E0
                                                                                                                                                              SHA-512:4E48ACEBCD4E5F47E56F1985F35419B61694788FBDADC7B698FBE3E05276FA20F403451DEF3CC7F17EA890CBFC8103E3638564BD717417C80F4318BDD959588E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13365805158137310","alternate_error_pages":{"backup":true,"enabled":false},"autocomplete":{"retention_policy_last_version":117},"autofill":{"autostuff_enabled":false,"credit_card_enabled":false,"custom_data_enabled":false,"custom_data_fill_enabled":false,"custom_data_identify_info_from_form_enabled":false,"custom_data_save_enabled":false},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"browser_content_container_height":140,"browser_content_container_width":407,"browser_content_container_x":0,"browser_content_container_y":0,"countryid_at_install":17224,"credentials_enable_service":false,"dips_timer_last_update":"13365805158055870","domain_diversity":{"last_reporting_timestamp":"13365805158136480"},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Preferences~RF66730d.TMP (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):5971
                                                                                                                                                              Entropy (8bit):4.816979185339521
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:stR/e6s13Gb9qG8zS85eh6Cb7/x+6MhmuecD61eAeEsE2MR7K:stF7sjGkS88bV+Fv6QAwEPhK
                                                                                                                                                              MD5:7224C47E36076D15C6413F60B252F1E4
                                                                                                                                                              SHA1:0706092AD2D4B760687B71F19B9DD2E0B6525FDE
                                                                                                                                                              SHA-256:36E4EB55E0523141FE37F69695090C43068A80ADF620E0DC3651731316DCA6E0
                                                                                                                                                              SHA-512:4E48ACEBCD4E5F47E56F1985F35419B61694788FBDADC7B698FBE3E05276FA20F403451DEF3CC7F17EA890CBFC8103E3638564BD717417C80F4318BDD959588E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13365805158137310","alternate_error_pages":{"backup":true,"enabled":false},"autocomplete":{"retention_policy_last_version":117},"autofill":{"autostuff_enabled":false,"credit_card_enabled":false,"custom_data_enabled":false,"custom_data_fill_enabled":false,"custom_data_identify_info_from_form_enabled":false,"custom_data_save_enabled":false},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"browser_content_container_height":140,"browser_content_container_width":407,"browser_content_container_x":0,"browser_content_container_y":0,"countryid_at_install":17224,"credentials_enable_service":false,"dips_timer_last_update":"13365805158055870","domain_diversity":{"last_reporting_timestamp":"13365805158136480"},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Preferences~RF66bcc8.TMP (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):5971
                                                                                                                                                              Entropy (8bit):4.816979185339521
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:stR/e6s13Gb9qG8zS85eh6Cb7/x+6MhmuecD61eAeEsE2MR7K:stF7sjGkS88bV+Fv6QAwEPhK
                                                                                                                                                              MD5:7224C47E36076D15C6413F60B252F1E4
                                                                                                                                                              SHA1:0706092AD2D4B760687B71F19B9DD2E0B6525FDE
                                                                                                                                                              SHA-256:36E4EB55E0523141FE37F69695090C43068A80ADF620E0DC3651731316DCA6E0
                                                                                                                                                              SHA-512:4E48ACEBCD4E5F47E56F1985F35419B61694788FBDADC7B698FBE3E05276FA20F403451DEF3CC7F17EA890CBFC8103E3638564BD717417C80F4318BDD959588E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13365805158137310","alternate_error_pages":{"backup":true,"enabled":false},"autocomplete":{"retention_policy_last_version":117},"autofill":{"autostuff_enabled":false,"credit_card_enabled":false,"custom_data_enabled":false,"custom_data_fill_enabled":false,"custom_data_identify_info_from_form_enabled":false,"custom_data_save_enabled":false},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"browser_content_container_height":140,"browser_content_container_width":407,"browser_content_container_x":0,"browser_content_container_y":0,"countryid_at_install":17224,"credentials_enable_service":false,"dips_timer_last_update":"13365805158055870","domain_diversity":{"last_reporting_timestamp":"13365805158136480"},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\PreferredApps

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):33
                                                                                                                                                              Entropy (8bit):4.051821770808046
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:YVXADAEvTLSJ:Y9AcEvHSJ
                                                                                                                                                              MD5:2B432FEF211C69C745ACA86DE4F8E4AB
                                                                                                                                                              SHA1:4B92DA8D4C0188CF2409500ADCD2200444A82FCC
                                                                                                                                                              SHA-256:42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
                                                                                                                                                              SHA-512:948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:{"preferred_apps":[],"version":1}

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\README

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:ASCII text, with no line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):182
                                                                                                                                                              Entropy (8bit):4.2629097520179995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:RGXKRjg0QwVIWRKXECSAV6jDyhjgHGAW+LB2Z4MKLFE1SwhiFAfXQmWyKBPMwRgK:z3frsUpAQQgHGwB26MK8Sw06fXQmWtRT
                                                                                                                                                              MD5:643E00B0186AA80523F8A6BED550A925
                                                                                                                                                              SHA1:EC4056125D6F1A8890FFE01BFFC973C2F6ABD115
                                                                                                                                                              SHA-256:A0C9ABAE18599F0A65FC654AD36251F6330794BEA66B718A09D8B297F3E38E87
                                                                                                                                                              SHA-512:D91A934EAF7D9D669B8AD4452234DE6B23D15237CB4D251F2C78C8339CEE7B4F9BA6B8597E35FE8C81B3D6F64AE707C68FF492903C0EDC3E4BAF2C6B747E247D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:Microsoft Edge settings and storage represent user-selected preferences and information and MUST not be extracted, overwritten or modified except through Microsoft Edge defined APIs.

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Secure Preferences (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):6780
                                                                                                                                                              Entropy (8bit):5.580009976132893
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:vKi+Plf/ROoBpkF5d19iu7VaTEv9V5h5pg5vezodIU8SefSpsA5IOrMn3YPo0MGP:/irZ+9l5vSpFIOAn3go0iuT
                                                                                                                                                              MD5:1D5D2358B94F72F9A81D807E064E0180
                                                                                                                                                              SHA1:9F8ECC1D9C7B00D7516218E8C7BE65A1BF423EDD
                                                                                                                                                              SHA-256:A4125797F294634E0CB6A95E862354B871957A2A1090167E5A67DB52083B7379
                                                                                                                                                              SHA-512:8EA353B130B1D74124D202481DEFEA40D0C9E180A55F622C8FF56FE4BB347F47E152A3BA8F0B770F6133C3F7D2684C533FE09FEAC761847D93F6C2DBFF74E7E1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:{"extensions":{"settings":{"dgiklkfkllikcanfonkcabmbdfmgleag":{"active_permissions":{"api":[],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13365805156935535","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13365805156935535","location":5,"manifest":{"content_capabilities":{"include_globs":["https://*excel.officeapps.live.com/*","https://*onenote.officeapps.live.com/*","https://*powerpoint.officeapps.live.com/*","https://*word-edit.officeapps.live.com/*","https://*excel.officeapps.live.com.mcas.ms/*","https://*onenote.officeapps.live.com.mcas.ms/*","https://*word-edit.officeapps.live.com.mcas.ms/*","https://*excel.partner.officewebapps.cn/*","https://*onenote.partner.officewebapps.cn/*","https://*powerpoint.partner.officewebapps.cn/*","https://*word-edit.partner.officewebapps.cn/*","https://*excel.gov.online.office365.us/*","

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Session Storage\000001.dbtmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Session Storage\000003.log

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:modified
                                                                                                                                                              Size (bytes):375
                                                                                                                                                              Entropy (8bit):5.08794112753217
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:S85af+StlaDwLmTf1gR/xoVzw9Wu+RVUhhhOgIMXXAiWuwLmTfOD:S+aTtUwLmT9UJoBw93fhnQswLmTK
                                                                                                                                                              MD5:0058FD46B02D93F8F73EC0A78CA08A21
                                                                                                                                                              SHA1:E9133DAB04976DC785DBF8A6BE56515133143771
                                                                                                                                                              SHA-256:907272595C116C96A8F88399B1DF2DAA71811532D14709DCB1FD5E0FC0BA5432
                                                                                                                                                              SHA-512:AA35687240D20585027008A648AA63519C2DDFC15DB4DBFC6B9193A8F2A656058E2FF96FD47C8B6F42526413EDCA6744549426CD31653A3EE669ECC1FBE1152F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:*...#................version.1..namespace-O.tDj................next-map-id.1.Knamespace-b2bb3146_595f_46fb_9419_b6473c8c4dcb-https://inside.bitcomet.com/.0.t.`m................next-map-id.2.Nnamespace-807c7fdb_9a7b_401b_b85c_a281f0332bbd-https://appassets.bitcomet.com/.1..d.a................next-map-id.3.Bnamespace-b2bb3146_595f_46fb_9419_b6473c8c4dcb-https://apphit.com/.2

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Session Storage\CURRENT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Session Storage\LOG

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):269
                                                                                                                                                              Entropy (8bit):5.270286999856846
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:BQOjBB1wkn23NLdWQM72KLlrQ4FDH39+q2Pwkn23NLdWQMxIFUv:hdkfXIL5VIvYfXHFUv
                                                                                                                                                              MD5:A3CA7705319C2BB61CE0EE8EB411F035
                                                                                                                                                              SHA1:F7A5F552C3B9597561EF3BB93DC1293FC08EAE95
                                                                                                                                                              SHA-256:98579B2D9612B6F6C2FD3262CC75CD1ECCD75E178FFFD5E2941E784071FC4E8C
                                                                                                                                                              SHA-512:43F4750E9746794D7E20D43876DD4200A0BE12C791CD8F5B776AA801429D3BEA8C9D13DD433F6D4CBE9ADF45A2340BFAA0D5E55BA24D080DACE5E85805905DEC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2024/07/18-15:39:20.584 1ad8 Creating DB C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Session Storage since it was missing..2024/07/18-15:39:20.887 1ad8 Reusing MANIFEST C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Session Storage/MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Session Storage\MANIFEST-000001

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41
                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Site Characteristics Database\000001.dbtmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Site Characteristics Database\000003.log

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):40
                                                                                                                                                              Entropy (8bit):3.473726825238924
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:41tt0diERGn:et084G
                                                                                                                                                              MD5:148079685E25097536785F4536AF014B
                                                                                                                                                              SHA1:C5FF5B1B69487A9DD4D244D11BBAFA91708C1A41
                                                                                                                                                              SHA-256:F096BC366A931FBA656BDCD77B24AF15A5F29FC53281A727C79F82C608ECFAB8
                                                                                                                                                              SHA-512:C2556034EA51ABFBC172EB62FF11F5AC45C317F84F39D4B9E3DDBD0190DA6EF7FA03FE63631B97AB806430442974A07F8E81B5F7DC52D9F2FCDC669ADCA8D91F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.On.!................database_metadata.1

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Site Characteristics Database\CURRENT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Site Characteristics Database\LOG

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):297
                                                                                                                                                              Entropy (8bit):5.218328874361301
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:BQPtT1RoM1wkn23NLdUUh2gr52KLlrQPkq2Pwkn23NLdUUh2ghZIFUv:qhcrfXrhHJLSkvYfXrhHh2FUv
                                                                                                                                                              MD5:F338222AF5FBD58D54653776E3841FCC
                                                                                                                                                              SHA1:3015BB002C2AF54E2E7E4F9715B7A7945806C3D0
                                                                                                                                                              SHA-256:4CA1B822E37819381D615F58713538D0766557017BFED76FE2377998C5FD9FF6
                                                                                                                                                              SHA-512:EA9884066CE93A33D7447EA87945860F86EC6649915D0C713EF4B4C7A4F5B50D5EDE504966855E1E48B6D8DCA01C0E5B4C255B22355F05833EA0CDD999D7CD16
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2024/07/18-15:39:17.246 1144 Creating DB C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Site Characteristics Database since it was missing..2024/07/18-15:39:17.493 1144 Reusing MANIFEST C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Site Characteristics Database/MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Site Characteristics Database\MANIFEST-000001

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41
                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Sync Data\LevelDB\000001.dbtmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Sync Data\LevelDB\000003.log

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):46
                                                                                                                                                              Entropy (8bit):4.019797536844534
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:sLollttz6sjlGXU2tkn:qolXtWswXU2tkn
                                                                                                                                                              MD5:90881C9C26F29FCA29815A08BA858544
                                                                                                                                                              SHA1:06FEE974987B91D82C2839A4BB12991FA99E1BDD
                                                                                                                                                              SHA-256:A2CA52E34B6138624AC2DD20349CDE28482143B837DB40A7F0FBDA023077C26A
                                                                                                                                                              SHA-512:15F7F8197B4FC46C4C5C2570FB1F6DD73CB125F9EE53DFA67F5A0D944543C5347BDAB5CCE95E91DD6C948C9023E23C7F9D76CFF990E623178C92F8D49150A625
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:...n'................_mts_schema_descriptor...

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Sync Data\LevelDB\CURRENT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Sync Data\LevelDB\LOG

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):273
                                                                                                                                                              Entropy (8bit):5.301683582799042
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:BQjSB1wkn23NLdgx2KLlrQcVX9+q2Pwkn23NLdWIFUv:SfXgVLdovYfXPFUv
                                                                                                                                                              MD5:A3905CED98038D23F5A460334C66E68A
                                                                                                                                                              SHA1:A3383C3369E853A952A8C0C72E90A139B62EA440
                                                                                                                                                              SHA-256:BE59057D2E9D6BFF49BBA87422CD02D76861F67982A46D1672E6D70772C3C378
                                                                                                                                                              SHA-512:0C4EB205AEA1968F6C0E1C51AB17A7A5A98E9EFA39C6F9354F8B596D79EA0A8B808803D584EB04E6B565CABCA821E5EABC85F92584305C1A1F08590B5C5D1E47
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2024/07/18-15:39:18.113 1808 Creating DB C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Sync Data\LevelDB since it was missing..2024/07/18-15:39:18.234 1808 Reusing MANIFEST C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Sync Data\LevelDB/MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41
                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Top Sites

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):20480
                                                                                                                                                              Entropy (8bit):0.3528485475628876
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:TLiN6CZhDu6MvDOF5yEHFxOUwa5qguYZ75fOSiPe2d:TLiwCZwE8I6Uwcco5fBtC
                                                                                                                                                              MD5:F2B4FB2D384AA4E4D6F4AEB0BBA217DC
                                                                                                                                                              SHA1:2CD70CFB3CE72D9B079170C360C1F563B6BF150E
                                                                                                                                                              SHA-256:1ECC07CD1D383472DAD33D2A5766625009EA5EACBAEDE2417ADA1842654CBBC8
                                                                                                                                                              SHA-512:48D03991660FA1598B3E002F5BC5F0F05E9696BCB2289240FA8CCBB2C030CDD23245D4ECC0C64DA1E7C54B092C3E60AE0427358F63087018BF0E6CEDC471DD34
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................j..........g.....4....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Visited Links

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):131072
                                                                                                                                                              Entropy (8bit):0.007803143776156301
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:ImtV+cBl/dXZ//tgz5rI6o7976clX3sf1:IiV+cLo1IP97c
                                                                                                                                                              MD5:57380EC029057814D0EA7EF1677B730D
                                                                                                                                                              SHA1:770E73104B4B50AADA5DE6C447511E647F72FD06
                                                                                                                                                              SHA-256:DBCEF9FE268EA3B4C2760EE344D6E0E0BA88E9EB05FF52251D0BF509603845DC
                                                                                                                                                              SHA-512:AE9F8B9A531CDD3F8D3C0BA208523F87C351024C6C72F96ED7F939BEA24C1CAEC7E437B426989E076B14F7463BE6EABC2607D61FB1D4BD9D6B45C559E6023A87
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:VLnk.....?......d.U/..E................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Web Data

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 87, cookie 0x36, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):178176
                                                                                                                                                              Entropy (8bit):0.9328712687751187
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:R2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+c:R2qOB1nxCkvSAELyKOMq+c
                                                                                                                                                              MD5:6B2D5ED0A90C99FD05D58FE8E924C886
                                                                                                                                                              SHA1:34E1103E18E57E9D1769C89DFB2DAD84BFDD54B5
                                                                                                                                                              SHA-256:2873E973AB5B91CD07405FD5D35E2A843A408AD53696372BEC794F4582368E49
                                                                                                                                                              SHA-512:08373748A19C0381866090CB60929A4642BB624AF777240CB63B918180CEEE0C80DFAD852830FC6821AD6266DF1A865940A90D2089621F612617C5E92A4B29B2
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:SQLite format 3......@ .......W...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\Web Data-journal

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2568
                                                                                                                                                              Entropy (8bit):0.06569804787746028
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:loHl1lOtlX:6HO
                                                                                                                                                              MD5:A70668C121EEA606D9E9ABCEC8F550E4
                                                                                                                                                              SHA1:BF0591D984BB0F5C470A7CB9FA4446D111E8E8EB
                                                                                                                                                              SHA-256:0FFCB5266C7E5E8CA34DF86BE9D31072C2D29ACD43754EC1E45D450EE0817330
                                                                                                                                                              SHA-512:958B666FB210167A0502D9667D244E98C2CE19C02BF38252B2D2D41C34239191F90A1A5815665EF27E42172702023F1F38F147E67C172801BB64959694C78DFD
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..............H...W....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\a9b093fc-21e6-43c6-951e-77619486fac7.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):6068
                                                                                                                                                              Entropy (8bit):4.821006591711512
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:stR/e6s13Gb9qG8zU85eh6Cb7/x+6MhmuecD61eAeEst2MR7K:stF7sjGkU88bV+Fv6QAwtPhK
                                                                                                                                                              MD5:B7E38967DEBAA6A171D4535A42F22C16
                                                                                                                                                              SHA1:2728DB2F4629B5B53493B7420501983029214052
                                                                                                                                                              SHA-256:EBE7A7502C68FD31292FB00CB92C8BC9D4D432E1EC8851946D4703F0BA452DE9
                                                                                                                                                              SHA-512:268ACE0713BF61F7466A0B80903EB617B5C57BBAAED984C0BBF810971D500A48AE6FADAD68BF290402C2D7081FCB8EA13775C64C91B2AD45AB25B4758E314E45
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13365805158137310","alternate_error_pages":{"backup":true,"enabled":false},"autocomplete":{"retention_policy_last_version":117},"autofill":{"autostuff_enabled":false,"credit_card_enabled":false,"custom_data_enabled":false,"custom_data_fill_enabled":false,"custom_data_identify_info_from_form_enabled":false,"custom_data_save_enabled":false},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"browser_content_container_height":140,"browser_content_container_width":407,"browser_content_container_x":0,"browser_content_container_y":0,"countryid_at_install":17224,"credentials_enable_service":false,"dips_timer_last_update":"13365805158055870","domain_diversity":{"last_reporting_timestamp":"13365805158136480"},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\b1f55af3-07aa-43d7-949c-0a03689fd466.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):5971
                                                                                                                                                              Entropy (8bit):4.816979185339521
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:stR/e6s13Gb9qG8zS85eh6Cb7/x+6MhmuecD61eAeEsE2MR7K:stF7sjGkS88bV+Fv6QAwEPhK
                                                                                                                                                              MD5:7224C47E36076D15C6413F60B252F1E4
                                                                                                                                                              SHA1:0706092AD2D4B760687B71F19B9DD2E0B6525FDE
                                                                                                                                                              SHA-256:36E4EB55E0523141FE37F69695090C43068A80ADF620E0DC3651731316DCA6E0
                                                                                                                                                              SHA-512:4E48ACEBCD4E5F47E56F1985F35419B61694788FBDADC7B698FBE3E05276FA20F403451DEF3CC7F17EA890CBFC8103E3638564BD717417C80F4318BDD959588E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13365805158137310","alternate_error_pages":{"backup":true,"enabled":false},"autocomplete":{"retention_policy_last_version":117},"autofill":{"autostuff_enabled":false,"credit_card_enabled":false,"custom_data_enabled":false,"custom_data_fill_enabled":false,"custom_data_identify_info_from_form_enabled":false,"custom_data_save_enabled":false},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"browser_content_container_height":140,"browser_content_container_width":407,"browser_content_container_x":0,"browser_content_container_y":0,"countryid_at_install":17224,"credentials_enable_service":false,"dips_timer_last_update":"13365805158055870","domain_diversity":{"last_reporting_timestamp":"13365805158136480"},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\heavy_ad_intervention_opt_out.db

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16384
                                                                                                                                                              Entropy (8bit):0.35226517389931394
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
                                                                                                                                                              MD5:D2CCDC36225684AAE8FA563AFEDB14E7
                                                                                                                                                              SHA1:3759649035F23004A4C30A14C5F0B54191BEBF80
                                                                                                                                                              SHA-256:080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
                                                                                                                                                              SHA-512:1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\shared_proto_db\000001.dbtmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\shared_proto_db\000003.log

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):100
                                                                                                                                                              Entropy (8bit):3.2073824618951257
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:VVXntjQPEnjQvxljl:/XntM+4ljl
                                                                                                                                                              MD5:72BE20D992CF12FF688D9C672A7EDAFD
                                                                                                                                                              SHA1:7D01A82EED7DD41776B04E0F9CC80059EA9715E3
                                                                                                                                                              SHA-256:C83848B49A734F0892972625B70108D27ABFC1A5B799D91C3CE11B89D5E51194
                                                                                                                                                              SHA-512:ED0A108AB089F3CDE11DA9409FF15EC94442B726863423C0E87EEAF47A3B112ADB4B92D4D28BA0B0F01A2DA112821D010186D3E40D0804DCCA6C33A07385382D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:A..r.................20_1_1...1.,U.................20_1_1...1..&f.................&f...............

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\shared_proto_db\CURRENT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\shared_proto_db\LOG

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):267
                                                                                                                                                              Entropy (8bit):5.396531468056327
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:BQN61wkn23NLd4rl2KLlrQf+q2Pwkn23NLd4rK+IFUv:efXqLnvYfX53FUv
                                                                                                                                                              MD5:6730AB98E4E18F208D23A9370400C763
                                                                                                                                                              SHA1:0BE40F2906E790D7EDB8A06F513EAC99929C88A7
                                                                                                                                                              SHA-256:86CF2C23C759353AF2CEBAC1CE9BB79619F78C19FCD1DCE537BB88DEED641DEA
                                                                                                                                                              SHA-512:622D73D1C638C35DB6AB62C801D979B7B594B1B988583C248B519A7A5762AD5FADF8254386692CC851E0388C3E0AA60026D0CFECEE399D744957FACB5493A6B1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2024/07/18-15:39:18.445 a68 Creating DB C:\Users\user\AppData\Local\BitComet\EBWebView\Default\shared_proto_db since it was missing..2024/07/18-15:39:18.532 a68 Reusing MANIFEST C:\Users\user\AppData\Local\BitComet\EBWebView\Default\shared_proto_db/MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\shared_proto_db\MANIFEST-000001

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41
                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\shared_proto_db\metadata\000001.dbtmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\shared_proto_db\metadata\000003.log

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):443
                                                                                                                                                              Entropy (8bit):3.8573208999772466
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:G0Xtqcsqc9Ct3mxKm9HTl1mL//3mQtmF2lHDNm8sL/3mF2lCQWmF2loDll1mtKca:G0nYUteza//z3iL/ZCbM8HlT0
                                                                                                                                                              MD5:B46C79CAE09B8CCF927797018DAB5864
                                                                                                                                                              SHA1:190F81A53C3667383D92974146682D0312F73738
                                                                                                                                                              SHA-256:EA38C0140416118373D628DCDE52D7528B0071334BC00001CDDDDA8E5A7B5A13
                                                                                                                                                              SHA-512:C358CBB98C8301907C44DB9470B378A8FE27ECD13F5FD615268BAAFB2723402A7C803117A83994C4F3556A7AF301F0BBA7812F136CF48F724FC86B61764F4A3B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.h.6.................__global... .t...................__global... .9..b.................33_..........................21_.....n[.=.................33_.....vuNX.................21_.....<...................20_.....,.1..................19_.....T....................20_......Q...................20_..........................18_.......ln.................19_......Y...................18_.....%.{..................9_.....f..U.................9_.....

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\shared_proto_db\metadata\CURRENT (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16
                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\shared_proto_db\metadata\LOG

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):285
                                                                                                                                                              Entropy (8bit):5.327206443306924
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:BQ0/1wkn23NLd4rzs52KLlrQI4+q2Pwkn23NLd4rzAdIFUv:sfX59LtNvYfXuFUv
                                                                                                                                                              MD5:3987CDE8257EDBE8D2ECD51E42C527FB
                                                                                                                                                              SHA1:35B71803385B3CD4887012C58F282DFB75DE9288
                                                                                                                                                              SHA-256:218F61F16D2E658C10E168CC0C4B2DC492650C15B2CFC95AB2111C031EB07ADD
                                                                                                                                                              SHA-512:3A91D48E7D8512079854C35C48E0CE161012C317185B4BC93AF18E9FF495EE66474BB65160FF5C38A6AC199F637B480A8DBF8825F3E310D1615521682DC88D01
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2024/07/18-15:39:18.168 a68 Creating DB C:\Users\user\AppData\Local\BitComet\EBWebView\Default\shared_proto_db\metadata since it was missing..2024/07/18-15:39:18.213 a68 Reusing MANIFEST C:\Users\user\AppData\Local\BitComet\EBWebView\Default\shared_proto_db\metadata/MANIFEST-000001.

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):41
                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\GrShaderCache\data_0

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.01057775872642915
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:MsFl:/F
                                                                                                                                                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\GrShaderCache\data_1

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):270336
                                                                                                                                                              Entropy (8bit):8.280239615765425E-4
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:MsEllllkEthXllkl2:/M/xT02
                                                                                                                                                              MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                              SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                              SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                              SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\GrShaderCache\data_2

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.011852361981932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:MsHlDll:/H
                                                                                                                                                              MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\GrShaderCache\data_3

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.012340643231932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:MsGl3ll:/y
                                                                                                                                                              MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\GrShaderCache\index

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):262512
                                                                                                                                                              Entropy (8bit):9.553120663130604E-4
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:LsNlhSclll:Ls3d
                                                                                                                                                              MD5:A8E07DE525AE91185205528B22015A2F
                                                                                                                                                              SHA1:593A11E85A3A743CE1BC7A14699903392298E728
                                                                                                                                                              SHA-256:ED1A6806D81858329E04A4B2374FE3628AB65BBC15F9EEE6D5CEDA67FFE98537
                                                                                                                                                              SHA-512:A44F54F3C5685C9BB09D33E916930D6F5C2AAADE5E6F8EBC5C1482840144DF3E58F207B1F2657373CB560182F108078E4D050118FB522F7B2035995066B3410F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.........................................}..!|/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\GraphiteDawnCache\data_0

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.01057775872642915
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:MsFl:/F
                                                                                                                                                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\GraphiteDawnCache\data_1

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):270336
                                                                                                                                                              Entropy (8bit):8.280239615765425E-4
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:MsEllllkEthXllkl2:/M/xT02
                                                                                                                                                              MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                              SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                              SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                              SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\GraphiteDawnCache\data_2

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.011852361981932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:MsHlDll:/H
                                                                                                                                                              MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\GraphiteDawnCache\data_3

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.012340643231932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:MsGl3ll:/y
                                                                                                                                                              MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\GraphiteDawnCache\index

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):262512
                                                                                                                                                              Entropy (8bit):9.553120663130604E-4
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:LsNlWbl:Ls3
                                                                                                                                                              MD5:C437ECEA09D99D82D4145EE3429E3630
                                                                                                                                                              SHA1:3642AFCFED6BA1EDFD2A4EE0A6AA696562E3A136
                                                                                                                                                              SHA-256:301256EF1D078EB60A70B25C43813106A36751F7D2D52CD2963DCD1052475198
                                                                                                                                                              SHA-512:DFC569CB71347FC008E51E1D53415864BE273F5223A5B65ECEB45945542C11B2CEEC74843BC6CBD6135BB49F04F2FE3E0530CC6AD6D8CE5D2BF20C096AA3BA17
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.........................................U..!|/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Last Version

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:ASCII text, with no line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):13
                                                                                                                                                              Entropy (8bit):2.7192945256669794
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:NYLFRQI:ap2I
                                                                                                                                                              MD5:BF16C04B916ACE92DB941EBB1AF3CB18
                                                                                                                                                              SHA1:FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
                                                                                                                                                              SHA-256:7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
                                                                                                                                                              SHA-512:F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:117.0.2045.47

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Local State (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):950
                                                                                                                                                              Entropy (8bit):5.748350049151981
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:YKWJu5rrtskJNqzVJskJBBV8eBPWaeCUWODLbvXmQQRCYfYg:Yqf5aJsAXpBPWZHD3vXB0
                                                                                                                                                              MD5:7FD254E5E895FCB8158F4E19B9222E78
                                                                                                                                                              SHA1:3A958AA816CDE7B298C1D33B57B27D5FD74ECDDF
                                                                                                                                                              SHA-256:795C4D3710B515D709D586F5897D5941DB3307D5040B04DB4382011219BA57B6
                                                                                                                                                              SHA-512:EADC9A11000DBDB5CCB1A3A7F83F7EB4240C3440C2767BBB8256E19CC2DDD975A08FA6FB6A37D9B017ECF17C3C733167DBA0F5530C8C1AF8FE61F11BCF029BEC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAG0C7h7XAqSqrfXwWIhDDYEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABUPsnoPsQBmf0uN5xQxsOYWJXZaDNmZfocSiMDLyQ/iAAAAAAOgAAAAAIAACAAAAA42RG+RF36XUzaDyBe1rGGWHDkQaYLBO8YO80rTW3ejjAAAAAWdbFGwBMIO8VJlmzUniG/SbuZBSd9WrqH3nPj5aY3uHGpyfHVx1gr/oz7Z8UqMypAAAAA4Vf1GYQuUbxbvWrwAqDCyfKzgkYBxgvTzcCQES9TWZniIT2/7ms7ayEVqHXecaOUSoQPkws5EXkT/cS5VKVyuQ=="},"uninstall_metrics":{"installation_date2":"1721331556"},"user_experience_metrics":{"client_id2":"{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}C:\\Users\\user0s:92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A","diagnostics":{"last_data_collection_level_on_launch":1},"low_entropy_source3":3221,"pseudo_low_entropy_source":3015,"reset_client_id_deterministic":true,"stability":{"browser_last_live_timestamp":"13365805156488690","stats_buildtime":"1695934310","stats_version":"117.0.2045.47-64","system_crash_count":0}}}

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Local State~RF661e36.TMP (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):950
                                                                                                                                                              Entropy (8bit):5.748350049151981
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:YKWJu5rrtskJNqzVJskJBBV8eBPWaeCUWODLbvXmQQRCYfYg:Yqf5aJsAXpBPWZHD3vXB0
                                                                                                                                                              MD5:7FD254E5E895FCB8158F4E19B9222E78
                                                                                                                                                              SHA1:3A958AA816CDE7B298C1D33B57B27D5FD74ECDDF
                                                                                                                                                              SHA-256:795C4D3710B515D709D586F5897D5941DB3307D5040B04DB4382011219BA57B6
                                                                                                                                                              SHA-512:EADC9A11000DBDB5CCB1A3A7F83F7EB4240C3440C2767BBB8256E19CC2DDD975A08FA6FB6A37D9B017ECF17C3C733167DBA0F5530C8C1AF8FE61F11BCF029BEC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAG0C7h7XAqSqrfXwWIhDDYEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABUPsnoPsQBmf0uN5xQxsOYWJXZaDNmZfocSiMDLyQ/iAAAAAAOgAAAAAIAACAAAAA42RG+RF36XUzaDyBe1rGGWHDkQaYLBO8YO80rTW3ejjAAAAAWdbFGwBMIO8VJlmzUniG/SbuZBSd9WrqH3nPj5aY3uHGpyfHVx1gr/oz7Z8UqMypAAAAA4Vf1GYQuUbxbvWrwAqDCyfKzgkYBxgvTzcCQES9TWZniIT2/7ms7ayEVqHXecaOUSoQPkws5EXkT/cS5VKVyuQ=="},"uninstall_metrics":{"installation_date2":"1721331556"},"user_experience_metrics":{"client_id2":"{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}C:\\Users\\user0s:92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A","diagnostics":{"last_data_collection_level_on_launch":1},"low_entropy_source3":3221,"pseudo_low_entropy_source":3015,"reset_client_id_deterministic":true,"stability":{"browser_last_live_timestamp":"13365805156488690","stats_buildtime":"1695934310","stats_version":"117.0.2045.47-64","system_crash_count":0}}}

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Local State~RF661e65.TMP (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):950
                                                                                                                                                              Entropy (8bit):5.748350049151981
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:YKWJu5rrtskJNqzVJskJBBV8eBPWaeCUWODLbvXmQQRCYfYg:Yqf5aJsAXpBPWZHD3vXB0
                                                                                                                                                              MD5:7FD254E5E895FCB8158F4E19B9222E78
                                                                                                                                                              SHA1:3A958AA816CDE7B298C1D33B57B27D5FD74ECDDF
                                                                                                                                                              SHA-256:795C4D3710B515D709D586F5897D5941DB3307D5040B04DB4382011219BA57B6
                                                                                                                                                              SHA-512:EADC9A11000DBDB5CCB1A3A7F83F7EB4240C3440C2767BBB8256E19CC2DDD975A08FA6FB6A37D9B017ECF17C3C733167DBA0F5530C8C1AF8FE61F11BCF029BEC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAG0C7h7XAqSqrfXwWIhDDYEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABUPsnoPsQBmf0uN5xQxsOYWJXZaDNmZfocSiMDLyQ/iAAAAAAOgAAAAAIAACAAAAA42RG+RF36XUzaDyBe1rGGWHDkQaYLBO8YO80rTW3ejjAAAAAWdbFGwBMIO8VJlmzUniG/SbuZBSd9WrqH3nPj5aY3uHGpyfHVx1gr/oz7Z8UqMypAAAAA4Vf1GYQuUbxbvWrwAqDCyfKzgkYBxgvTzcCQES9TWZniIT2/7ms7ayEVqHXecaOUSoQPkws5EXkT/cS5VKVyuQ=="},"uninstall_metrics":{"installation_date2":"1721331556"},"user_experience_metrics":{"client_id2":"{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}C:\\Users\\user0s:92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A","diagnostics":{"last_data_collection_level_on_launch":1},"low_entropy_source3":3221,"pseudo_low_entropy_source":3015,"reset_client_id_deterministic":true,"stability":{"browser_last_live_timestamp":"13365805156488690","stats_buildtime":"1695934310","stats_version":"117.0.2045.47-64","system_crash_count":0}}}

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Local State~RF66447b.TMP (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):950
                                                                                                                                                              Entropy (8bit):5.748350049151981
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:YKWJu5rrtskJNqzVJskJBBV8eBPWaeCUWODLbvXmQQRCYfYg:Yqf5aJsAXpBPWZHD3vXB0
                                                                                                                                                              MD5:7FD254E5E895FCB8158F4E19B9222E78
                                                                                                                                                              SHA1:3A958AA816CDE7B298C1D33B57B27D5FD74ECDDF
                                                                                                                                                              SHA-256:795C4D3710B515D709D586F5897D5941DB3307D5040B04DB4382011219BA57B6
                                                                                                                                                              SHA-512:EADC9A11000DBDB5CCB1A3A7F83F7EB4240C3440C2767BBB8256E19CC2DDD975A08FA6FB6A37D9B017ECF17C3C733167DBA0F5530C8C1AF8FE61F11BCF029BEC
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAG0C7h7XAqSqrfXwWIhDDYEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABUPsnoPsQBmf0uN5xQxsOYWJXZaDNmZfocSiMDLyQ/iAAAAAAOgAAAAAIAACAAAAA42RG+RF36XUzaDyBe1rGGWHDkQaYLBO8YO80rTW3ejjAAAAAWdbFGwBMIO8VJlmzUniG/SbuZBSd9WrqH3nPj5aY3uHGpyfHVx1gr/oz7Z8UqMypAAAAA4Vf1GYQuUbxbvWrwAqDCyfKzgkYBxgvTzcCQES9TWZniIT2/7ms7ayEVqHXecaOUSoQPkws5EXkT/cS5VKVyuQ=="},"uninstall_metrics":{"installation_date2":"1721331556"},"user_experience_metrics":{"client_id2":"{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}C:\\Users\\user0s:92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A","diagnostics":{"last_data_collection_level_on_launch":1},"low_entropy_source3":3221,"pseudo_low_entropy_source":3015,"reset_client_id_deterministic":true,"stability":{"browser_last_live_timestamp":"13365805156488690","stats_buildtime":"1695934310","stats_version":"117.0.2045.47-64","system_crash_count":0}}}

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\ShaderCache\data_0

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.01057775872642915
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:MsFl:/F
                                                                                                                                                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\ShaderCache\data_1

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):270336
                                                                                                                                                              Entropy (8bit):8.280239615765425E-4
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:MsEllllkEthXllkl2:/M/xT02
                                                                                                                                                              MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                              SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                              SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                              SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\ShaderCache\data_2

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.011852361981932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:MsHlDll:/H
                                                                                                                                                              MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\ShaderCache\data_3

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.012340643231932763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:MsGl3ll:/y
                                                                                                                                                              MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\ShaderCache\index

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):262512
                                                                                                                                                              Entropy (8bit):9.553120663130604E-4
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:LsNlVS8l:Ls3V
                                                                                                                                                              MD5:C95249EDA033893BC7A209EFFAC6BA83
                                                                                                                                                              SHA1:A5B9EE2542DF3AAC93EC52AF36D1F5A79B0B1502
                                                                                                                                                              SHA-256:D3FE607DB28D74EA6379BDAD13B2530260384F3FD495D295A8E4EEEFD03E1770
                                                                                                                                                              SHA-512:098B8D3FB27227CAC2BB539E82008DC8D2F2D136DD3D42AE5E943A586F0BFFF47A79CC0EEDC96813773140C21EC7E8C12DB2654CF0A28B9AFFCC1710EF24299D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:........................................eS..!|/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\SmartScreen\RemoteData\customSettings

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:ASCII text, with no line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):47
                                                                                                                                                              Entropy (8bit):4.3818353308528755
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
                                                                                                                                                              MD5:48324111147DECC23AC222A361873FC5
                                                                                                                                                              SHA1:0DF8B2267ABBDBD11C422D23338262E3131A4223
                                                                                                                                                              SHA-256:D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
                                                                                                                                                              SHA-512:E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:customSettings_F95BA787499AB4FA9EFFF472CE383A14

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):35
                                                                                                                                                              Entropy (8bit):4.014438730983427
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
                                                                                                                                                              MD5:BB57A76019EADEDC27F04EB2FB1F1841
                                                                                                                                                              SHA1:8B41A1B995D45B7A74A365B6B1F1F21F72F86760
                                                                                                                                                              SHA-256:2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
                                                                                                                                                              SHA-512:A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:{"forceServiceDetermination":false}

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\SmartScreen\RemoteData\customSynchronousLookupUris

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:ASCII text, with no line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):29
                                                                                                                                                              Entropy (8bit):3.922828737239167
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:2NGw+K+:fwZ+
                                                                                                                                                              MD5:7BAAFE811F480ACFCCCEE0D744355C79
                                                                                                                                                              SHA1:24B89AE82313084BB8BBEB9AD98A550F41DF7B27
                                                                                                                                                              SHA-256:D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
                                                                                                                                                              SHA-512:70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:customSynchronousLookupUris_0

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\SmartScreen\RemoteData\customSynchronousLookupUris_0

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):35302
                                                                                                                                                              Entropy (8bit):7.99333285466604
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
                                                                                                                                                              MD5:0E06E28C3536360DE3486B1A9E5195E8
                                                                                                                                                              SHA1:EB768267F34EC16A6CCD1966DCA4C3C2870268AB
                                                                                                                                                              SHA-256:F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
                                                                                                                                                              SHA-512:45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-.*.F.1....g|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a.*...6g3..%.gy../{|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...|$....;.k.......*8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl.....*...}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\SmartScreen\RemoteData\edgeSettings

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:ASCII text, with no line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):81
                                                                                                                                                              Entropy (8bit):4.3439888556902035
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
                                                                                                                                                              MD5:177F4D75F4FEE84EF08C507C3476C0D2
                                                                                                                                                              SHA1:08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
                                                                                                                                                              SHA-256:21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
                                                                                                                                                              SHA-512:94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\SmartScreen\RemoteData\edgeSettings_2.0-0

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):3581
                                                                                                                                                              Entropy (8bit):4.459693941095613
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
                                                                                                                                                              MD5:BDE38FAE28EC415384B8CFE052306D6C
                                                                                                                                                              SHA1:3019740AF622B58D573C00BF5C98DD77F3FBB5CD
                                                                                                                                                              SHA-256:1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
                                                                                                                                                              SHA-512:9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):130439
                                                                                                                                                              Entropy (8bit):3.80180718117079
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
                                                                                                                                                              MD5:EB75CEFFE37E6DF9C171EE8380439EDA
                                                                                                                                                              SHA1:F00119BA869133D64E4F7F0181161BD47968FA23
                                                                                                                                                              SHA-256:48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
                                                                                                                                                              SHA-512:044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\SmartScreen\RemoteData\synchronousLookupUris

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:ASCII text, with no line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):40
                                                                                                                                                              Entropy (8bit):4.346439344671015
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:kfKbUPVXXMVQX:kygV5
                                                                                                                                                              MD5:6A3A60A3F78299444AACAA89710A64B6
                                                                                                                                                              SHA1:2A052BF5CF54F980475085EEF459D94C3CE5EF55
                                                                                                                                                              SHA-256:61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
                                                                                                                                                              SHA-512:C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:synchronousLookupUris_638343870221005468

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):35302
                                                                                                                                                              Entropy (8bit):7.99333285466604
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
                                                                                                                                                              MD5:0E06E28C3536360DE3486B1A9E5195E8
                                                                                                                                                              SHA1:EB768267F34EC16A6CCD1966DCA4C3C2870268AB
                                                                                                                                                              SHA-256:F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
                                                                                                                                                              SHA-512:45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-.*.F.1....g|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a.*...6g3..%.gy../{|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...|$....;.k.......*8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl.....*...}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):57
                                                                                                                                                              Entropy (8bit):4.556488479039065
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:GSCIPPlzYxi21goD:bCWBYx99D
                                                                                                                                                              MD5:3A05EAEA94307F8C57BAC69C3DF64E59
                                                                                                                                                              SHA1:9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
                                                                                                                                                              SHA-256:A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
                                                                                                                                                              SHA-512:6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\SmartScreen\RemoteData\topTraffic

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:ASCII text, with no line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):29
                                                                                                                                                              Entropy (8bit):4.030394788231021
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:0xXeZUSXkcVn:0Re5kcV
                                                                                                                                                              MD5:52E2839549E67CE774547C9F07740500
                                                                                                                                                              SHA1:B172E16D7756483DF0CA0A8D4F7640DD5D557201
                                                                                                                                                              SHA-256:F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
                                                                                                                                                              SHA-512:D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:topTraffic_638004170464094982

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):575056
                                                                                                                                                              Entropy (8bit):7.999649474060713
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
                                                                                                                                                              MD5:BE5D1A12C1644421F877787F8E76642D
                                                                                                                                                              SHA1:06C46A95B4BD5E145E015FA7E358A2D1AC52C809
                                                                                                                                                              SHA-256:C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
                                                                                                                                                              SHA-512:FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)*d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(|.6.:..f!.>...?M.8......P.D.J.I4.<...*.y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z*.{nZ~d.V.4.u.K.V.......X.<p..cz..>*....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\SmartScreen\RemoteData\topTraffic_638004170464094982

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:raw G3 (Group 3) FAX, byte-padded
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):460992
                                                                                                                                                              Entropy (8bit):7.999625908035124
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
                                                                                                                                                              MD5:E9C502DB957CDB977E7F5745B34C32E6
                                                                                                                                                              SHA1:DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
                                                                                                                                                              SHA-256:5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
                                                                                                                                                              SHA-512:B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<...*..Z..*%.*..._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..*4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z*.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^.*.T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d|.../....._...f.....d....Im..g.b..R.q.<x*x...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>*P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\SmartScreen\local\uriCache

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:ASCII text, with no line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):9
                                                                                                                                                              Entropy (8bit):3.169925001442312
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:CMzOn:CM6
                                                                                                                                                              MD5:B6F7A6B03164D4BF8E3531A5CF721D30
                                                                                                                                                              SHA1:A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
                                                                                                                                                              SHA-256:3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
                                                                                                                                                              SHA-512:4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:uriCache_

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\SmartScreen\local\uriCache_

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):179
                                                                                                                                                              Entropy (8bit):5.026905823943503
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:YTyLSmafBoTfwn9B8XTozRLuLgfGBkGAeekVy8HfzXNPIAckfW4WYV:YWLSGTuB8XTo9LuLgfGBPAzkVj/T87y
                                                                                                                                                              MD5:8934176BB325C5233C9ABF2F763BF15D
                                                                                                                                                              SHA1:5CCFABA73073A4F040690CA0934636282763D7BD
                                                                                                                                                              SHA-256:D8B4EC743423A05D98F187E9366E16128A92B45044945619341D8D8E4F75BFC3
                                                                                                                                                              SHA-512:F6F16A7E35BC77DA1507ED605E257281A6817218D17EE8FD55509DD0399D8F8EB1844608D5813F5553CAB05FE87A65F4E5CB819465B941972F0B21856802E206
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:{"version":1,"cache_data":[{"file_hash":"f37674d4d27a8d92","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1721438817233773}]}

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\Variations

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):86
                                                                                                                                                              Entropy (8bit):4.3751917412896075
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:YQ3JYq9xSs0dMEJAELJ2rjozQan:YQ3Kq9X0dMgAEwjM
                                                                                                                                                              MD5:961E3604F228B0D10541EBF921500C86
                                                                                                                                                              SHA1:6E00570D9F78D9CFEBE67D4DA5EFE546543949A7
                                                                                                                                                              SHA-256:F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
                                                                                                                                                              SHA-512:535F930AFD2EF50282715C7E48859CC2D7B354FF4E6C156B94D5A2815F589B33189FFEDFCAF4456525283E993087F9F560D84CFCF497D189AB8101510A09C472
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":0}

                                                                                                                                                              C:\Users\user\AppData\Local\BitComet\EBWebView\c133f3b8-2e86-4ec6-aff7-27fcee23b1e3.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2053
                                                                                                                                                              Entropy (8bit):5.48961010178799
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:YDEFMsFiHC0af5aJsAXVyM5nz6HB+0zdrxiBPWZHnfR3TXBG/d2a:PNkC1f5gsq/IBpsNWZHZ3TXI4a
                                                                                                                                                              MD5:62BC07983EDA6CE356E239D70BDDB15D
                                                                                                                                                              SHA1:09749C3427B1BD2B16B7FA731734EBE6DC1E9DA5
                                                                                                                                                              SHA-256:39CBD45F231AC0AD87EC07F208FE48CFCE500AD29552B42814B863D28929B80A
                                                                                                                                                              SHA-512:737927217557F3696564BB134608D38984760FF14D9430676C07DB0893E679098CD89FB5186101828950EC95520315184CD6868E28FB22ED9FDD40BDB76F0B3A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAG0C7h7XAqSqrfXwWIhDDYEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABUPsnoPsQBmf0uN5xQxsOYWJXZaDNmZfocSiMDLyQ/iAAAAAAOgAAAAAIAACAAAAA42RG+RF36XUzaDyBe1rGGWHDkQaYLBO8YO80rTW3ejjAAAAAWdbFGwBMIO8VJlmzUniG/SbuZBSd9WrqH3nPj5aY3uHGpyfHVx1gr/oz7Z8UqMypAAAAA4Vf1GYQuUbxbvWrwAqDCyfKzgkYBxgvTzcCQES9TWZniIT2/7ms7ayEVqHXecaOUSoQPkws5EXkT/cS5VKVyuQ=="},"policy":{"last_statistics_update":"13365805156823660"},"profile":{"info_cache":{},"profile_counts_reported":"13365805156844487","profiles_order":[]},

                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2278
                                                                                                                                                              Entropy (8bit):3.8349775928613807
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:uiTrlKxrgxdxl9Il8ud5Ch08iGUCS3uhvF5SFcd1rc:mYY9CO8itu5bo
                                                                                                                                                              MD5:E90BBD1ED523D499422813A9E7D2C3F7
                                                                                                                                                              SHA1:883657E5A384F64B4BF2D493D6FB2DB3797F303E
                                                                                                                                                              SHA-256:5C7A919B4BCF0190CD45E8ED57DC86D6DA0712E4FD118FC5BC0A05B656BFD69D
                                                                                                                                                              SHA-512:20361D476DB69C1C0B4A308F4890A8673D2CD5F9E50E331C0AEBBCF9B8839ABDC4210A4FB63951895E4EC0DF0CBE2E53DC7C35E27445A2D19D9E8BD2257680F5
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.O.Y.j.k.1.L.Z.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.B.t.A.u.4.e.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\2f04cdea-85ae-4580-8b24-6f19a8ee3b9c.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              File Type:GIF image data, version 89a, 32 x 32
                                                                                                                                                              Category:modified
                                                                                                                                                              Size (bytes):1787
                                                                                                                                                              Entropy (8bit):7.414935763896265
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:3WlS79lzzM5C0xOdPSsruXjidF8d7wRScVaUgVLI:3WQ799M5hgdPbu2SzcVaUgJI
                                                                                                                                                              MD5:50C5E3E79B276C92DF6CC52CAEB464F0
                                                                                                                                                              SHA1:C641615E851254111E268DA42D72AE684B3CE967
                                                                                                                                                              SHA-256:16EA0CF66D51EFDBBC2A62B11AB0419FA72FB3320844F1D0D710480245AC9925
                                                                                                                                                              SHA-512:06AFB0EE97D49B23B8DE5CCF940A95D8497FC0B19A169AACBE7924DD0A088DF65C3D1F4AE7D73A31A1FC7B5A1569FEDEAD1F1757C10C281A1DD61564B9CC39FA
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:GIF89a . ..........................444..............TTT...!..NETSCAPE2.0.....!.......,.... . ......I)K...JJ5....U.RK....(..&...05+/.mbp.z...1...;$.1C....I*..HCh`A.o..."3qT5.\.8a....B..d..wxG=Y..g...wHb..v.A=.0.V\.\.;........;...H.........0..t%.Hs..rY<H..........b..Z.b.OEg:...GY]..=.A.OQ.s....\b.h.9.=sg...c..e....*...f.7D..!.......,..........r..I..5.......bRH.h.W...*lkL&-).1-..v.m...).....M..t.\....Rd..A..H.... ......o...........................Gz{..!.......,..........r..Ig@5...rY.M.Q!(.(.(..8........J..Kb..r....3.h..K!..6..3u`.&.D.A..z.fL.Z*..^`n.F.....O..ssyJ}T....N.aqXshC..XJ...!.......,..........i....Y4.......Cv....A.M.A."....J..j..A'.0T....*.b..JI.I..ZF..P.MM...s.bg.qV$.......v.!...5....?}..........!.......,..........ep....80....#^.q..X....[..(\.-......S..@ P....0". ..L......z...xL..*Z....._..H......D..eU..ywZt.n..!.......,.....................A.2.W..E.&j....B.&..w~.6..b8....p`4r|.F..M.>......,bLv|?.4B.v.....P..u.9..+.&..2..x&...k..&...U]..vo...o..p..raT&..!

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\6358C710-B89F-46B9-93F2-F6CAC44F5286

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1128
                                                                                                                                                              Entropy (8bit):3.8586637013503444
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:V98uCnxROY5tF6slxp5jJlBZmbYfJrruKYlI+bZOWvlUj5G:V98u4ntiyHvBZmM8E+bZOYOQ
                                                                                                                                                              MD5:FBC962C02A8833B8FF8A8DABC24B2217
                                                                                                                                                              SHA1:715AD60EAEB114FEA26F537447D8E8A5AC3D2464
                                                                                                                                                              SHA-256:6E1C961C5B18779A44E1143138A026871953FDBB498EBF82DEDF1A6EF73AFB0D
                                                                                                                                                              SHA-512:4D35A318CE32DE67F7CFAB5B09484EDE9F998764661D9BDD0F6CB0209C799DCE855E17916FED0EFD3FD87BCFF6DC939DEDD0FBA2BD95869675D0DABE7E79790D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.b.P.A.C.K.j.Y.c.t.E.q.R.8.Q.i.Q.L.h.r.b.q.g.Q.A.A.A.A.C.A.A.A.A.A.A.A.Q.Z.g.A.A.A.A.E.A.A.C.A.A.A.A.B.e.U./.T.V.K.S.0.5.s.a.2.M.t.z.t.Z.t.I.O.Z.t.C.m.f.e.t.Y.2.Q.i.k.e.X.m.K.U.C.n.E.h.U.A.A.A.A.A.A.O.g.A.A.A.A.A.I.A.A.C.A.A.A.A.B.j.z.i.X.6.p.y.h.V.f.y.2.X.E.V.o.6.w.D.u.f.m.u.H.d.u.u.Q.S./.C.z.K.e.q.g.+.n./.1.D.y.N.A.A.A.A.D.n.e.O.A.6.F.q.e.B.Q.K.8.d.g.N.w.l.j.H.z.F.N.V.f.G.8.B.0.e.U.i.r.B.j.c.o.+.t.4.z.6.u.y.U.3.W.I.B.x.A.i.I.R.F.1.y.u.M.r.x.y.w.H.a./.6.i.h.n.9.B.f.h.5.h.I.4./.H.l.g.E.X.N.J.E.A.J.v.J.H.O.v.t.o.5.o.v.Q.6.B.e.W.R.M.b.N.p.b.y.H.w.p.4.d.0.O.W.2.b.p.O.Z.D.9.P.z.y.H.E.O.C.c.Z.j.z.W.i.g.f.F.n.F.w.o.C.0.A.l.4.A.x.Q.d.v.j.S.j.z.b.e.M.O.c.z.5.g.6.C.w.0.s.o.C.r.D.+.m.l.L.Q.H.V.D.K.o.v.6.2.J./.G.c.P.n.w.5.D.I.E.q.l.p.Y.9.i.d.2.f.C.K.w.l./.F.C.8.y.s.p.O.g.A.P.7.n.k.q.m.b.K.M.e.d.C.1.M.u.6.D.n.d.M.j.U.x.u.G.b.P.k.L.j.h.4.g.P.3.e.t.6.d.a.t.f.u.V.B.x.Q.H.5.M.+.e.G.F.Q.A.A.A.A.L.u.W.u.o.Y.1.o.z.Y.y.6.7.Q.Y.u.Y.+.v.A.R.M.2.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\D566D7D7-DCD6-471C-8109-BE0AD33199E3

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):64
                                                                                                                                                              Entropy (8bit):2.8068042503656208
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:blUlOPDclpWU8lmlLZPlzhj0klQ+Jl:ilSclpW38QkK+r
                                                                                                                                                              MD5:6C12B13D536A49853C1A959D7372543D
                                                                                                                                                              SHA1:C89E37DA554B0FED9392E4DE70F78A6690738A74
                                                                                                                                                              SHA-256:D309F7BBF2FB79FC4958675CFC1837F0430A3691432E8A8ECBCB9639F081C68D
                                                                                                                                                              SHA-512:5ACFF3B7BF82FA5343B86B1FD93B4F5F76D2B8BD8D7C6A48DB3D34C35C2759715643BA36F43275CF090E66BFE23CB092CB272B54678B4C435E7A04473E92133B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:2.4.1.9.F.1.B.3.8.4.9.6.3.3.8.C.C.D.C.3.F.6.D.D.D.0.D.C.A.5.A.6.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\F07D8C6A-04B6-4025-869C-70A788D7B5C0

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):72
                                                                                                                                                              Entropy (8bit):2.914619965908789
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:sAl1tRAwdlYGkGlMXflVl:x1MglY6kd
                                                                                                                                                              MD5:E3F552A74A128AC8ACE7AD1248221B0B
                                                                                                                                                              SHA1:5424554086428AA579C0FDC5B0872FC9F89791B2
                                                                                                                                                              SHA-256:4B727737A25D52D31056CF0D1FF10839ED1C9FC97CC19F2441E320F87BCBC5F6
                                                                                                                                                              SHA-512:F2FEDC732A2EFB7F1D84FCFC10FFCD4C7948DBC161B13C53E034F3A67ABA24E5A3F84482F74264E2CBAA2410D5A7E7F4E5BE94257D6B0F7162460584F4B10E51
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:9.7.7.2.f.3.3.d.-.b.2.b.c.-.4.c.9.4.-.b.5.a.9.-.5.2.e.d.9.a.8.2.5.d.1.0.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\Desktop\SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe
                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):3111424
                                                                                                                                                              Entropy (8bit):6.3985080559233944
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:49152:lLJwSihjOb6GLb4SKEs3DyOMC2DlUt0+yO3A32ASNTvfGU:rwSi0b67zeCzt0+yO3kSxn
                                                                                                                                                              MD5:DD40149397C65DB7E46877143552AAC5
                                                                                                                                                              SHA1:A520AA94A3EC3279C26410A58A40C5C37B037A8E
                                                                                                                                                              SHA-256:F4E460EDDF3D8408AE887AC53FE96906A3B534D99A5FD9C3FE7777948293D1F7
                                                                                                                                                              SHA-512:F1B651C2F26C49D7D9D7B04E5DC5AD0D8344C3C002C5119FEE8E038E8CC7AC06F0AD3729E20C98DA0BDAC1993FEA85F8F77B71D02E87E9E3859DE42F24D6C7F9
                                                                                                                                                              Malicious:true
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...p.._.................$,..R......P6,......@,...@..........................`0...........@......@....................-......`-.49....-.(u....................................................-......................i-.......-......................text...P.+.......+................. ..`.itext..t(....,..*....+............. ..`.data.......@,......(,.............@....bss.....x....,..........................idata..49...`-..:....,.............@....didata.......-.......,.............@....edata........-.......-.............@..@.tls....L.....-..........................rdata..].....-.......-.............@..@.rsrc...(u....-..v....-.............@..@......................-.............@..@........................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\AVG_AV.png (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp
                                                                                                                                                              File Type:PNG image data, 547 x 280, 8-bit/color RGBA, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):53151
                                                                                                                                                              Entropy (8bit):7.982330941208071
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:GcHlp3vMusTtWEgKqx8zHom+GChNPDViFKWUyG:Ggz3kTNgKq66VcFKW9G
                                                                                                                                                              MD5:AEE8E80B35DCB3CF2A5733BA99231560
                                                                                                                                                              SHA1:7BCF9FEB3094B7D79D080597B56A18DA5144CA7B
                                                                                                                                                              SHA-256:35BBD8F390865173D65BA2F38320A04755541A0783E9F825FDB9862F80D97AA9
                                                                                                                                                              SHA-512:DCD84221571BF809107F7AEAF94BAB2F494EA0431B9DADB97FEED63074322D1CF0446DBD52429A70186D3ECD631FB409102AFCF7E11713E9C1041CAACDB8B976
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...#............B....pHYs.................sRGB.........gAMA......a....4IDATx.......y...u.}...W."..(s ........p.........Q...?ql=...'.8....E.l...Y.-ah..FP.w.......__uUwuw.r.3X.z..........jcppph........O.appp..........n ..qph..88.......pd...y...!..888.##...._..C.8....Cn82...,.8...40....!7..qph..GF.2.........C.h....q#.........!7..qph.O..../_..p......B....K...`.XF.n}........S/b.._..?.XH.2q...i.}..y....c...8..b|~:WY...8....a......o...v..!.~.+8z...P.....y......2y^....!.w..C.=..'.J]..v. ..}./o..q....M...........<$.X.<)..g.gp......'.Y.I...'.x......D.(..C...m.. .:.#....$. .LdD.E...*..a..}..eih.A.....AyR...7a..2..N##DD^....Tg...;>$..tZo.....m......3.A..p....$MM.".hF.......qpX....7..F.=.k..e".G/...G~E.........4..kA.{....yN.dH)~.s...........#.W...lD.:..W}...#...kP.&...;....n......?..d....oH.....#..'a..s..D.....<.......h...y.....D..!.^...G....4.........c .;?$..6...@.....O c.......~.u...1.7......c.|..'...?/..#;.z&....T.M4.w.."....7W....

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp
                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):27549456
                                                                                                                                                              Entropy (8bit):7.999862727155135
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:786432:Ub3ToDaC5U52NWJprv2ATAknQ+PsrPSXEZxLDW:Ub3kDaMhNWvrusbMSX3
                                                                                                                                                              MD5:4F45F9BD3CC4739BDC91A4D183C0DC01
                                                                                                                                                              SHA1:3AEA9C61B316547343F5E1085441883A781379E3
                                                                                                                                                              SHA-256:E0CBC854E5F0FC653C3E1E68988CC5E0AAB1F66A4B7264CB09F490A28439061F
                                                                                                                                                              SHA-512:A4665E71FDEEA35186A15C8C25C9369E394F6631BC830AC7F7EBB4E29D6479F9BFB54E9E54056CCA0DE256E4C10F5DAC51C1F473903D5F184F5B78C5DBA01CB2
                                                                                                                                                              Malicious:true
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 17%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L...5.oZ.................f...........4............@..........................@...........@.............................................,............7...'...........................................................................................text....d.......f.................. ..`.rdata...............j..............@..@.data...X............~..............@....ndata...................................rsrc...,...........................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\_isetup\_setup64.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp
                                                                                                                                                              File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):6144
                                                                                                                                                              Entropy (8bit):4.720366600008286
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
                                                                                                                                                              MD5:E4211D6D009757C078A9FAC7FF4F03D4
                                                                                                                                                              SHA1:019CD56BA687D39D12D4B13991C9A42EA6BA03DA
                                                                                                                                                              SHA-256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
                                                                                                                                                              SHA-512:17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\error.png

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp
                                                                                                                                                              File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):7152
                                                                                                                                                              Entropy (8bit):7.94999820743332
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:4LdFSNv8YAa1cSXVoRTzU8SbrOr9yKdeD7UU0:4hFSNvUkcSFoRTz4mnecl
                                                                                                                                                              MD5:84655B67373CBF75DF620481A2A2C092
                                                                                                                                                              SHA1:E9B5C0650C6F8D3B4120428F80FBEE36D168F0B3
                                                                                                                                                              SHA-256:DE17422973741F1F199B5654095D759D92A737E51BBD6A0AAE1A1D695E3C334E
                                                                                                                                                              SHA-512:15263AF20D627D2E84C55CBA38014A77EA51F0044D4FB801EAFA35DB5E832206AD96795B84EFF28A889DE2D31980017F6141CE4B678A0D08E8D4077689215E42
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...@...@......iq.....sRGB.........gAMA......a.....pHYs..........+......IDATx^....]u}....7......$$........`...VO]....j..m..V.i...p..[q.(.@.@..lM.!$a..0.d......~..{..e.`".?........[...x!d...b...V....m......a.}.fcC...n...Z..n..a^...g.7o..K->...)f.G...../.A`a>k.V^......p.n.B.<...2.o4K..9.Y.c...0.e...K.\.`....G.>.......................V~....{Q.L..;...n..e./^n...f....."..rf..-....,xu..].-.:..p....^.S..........|\.xs.....d.......X...yM-./;.Rg.2..fu..!l@`<..JO..`.o,.....#.....~...U4....w..).......n...f.j...L...U...w..1#...H.t..VX{..._s..3..h....Z.?.<....F...Z/..?.w......^...i;...d....K...+..V..f........x._Z.G>mU.f..5...a6c......q..B...EK-<.||._pR<..Gb...g.[.......!K.|..<..|..z.....(...G......{.yS.p.sO.,}.-u..........,.n...%+...R.jj..5.i..|R...Q......~l..Op.r..[...0o......5...H.g..Z.[...?'X......_o.....u..o....RQ......4....1.g...?c...I$.(Q...I..i.D.d..u...#Q..k.[...m..R..i.R....>t.....o.."}.g..=.....Ys-..k"7.L*jFa.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\finish.png

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp
                                                                                                                                                              File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):7130
                                                                                                                                                              Entropy (8bit):7.950768491625489
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:uJxX+FFEZQWNHgQl5ZFik4e5yBbaBrURjF3B5KDXwMaIZjHx1kB224QC+N9Kc:pK9Hlf4eO0rM3BO3ZjHH03BNd
                                                                                                                                                              MD5:7A06E342E34F0E4833756F71275E8168
                                                                                                                                                              SHA1:FD230C8CB2EA99365E021F560FC2FDD637A00847
                                                                                                                                                              SHA-256:8C6498EF75B73C26B5D2498DDD7444F4C9735D62FFACA947C6CDC65EA40A9BEF
                                                                                                                                                              SHA-512:D31C7FB72D6845133CE83C178CF2436E100B95B731183AE9C05BE7A5DDAF69EA29ADAFD1BDCEA94D92F3472B084138CD53D959DAD37A24BC4CAE79EC5A000EF5
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...@...@......iq.....sRGB.........gAMA......a.....pHYs..........+.....oIDATx^....]ey..s.}..dO.B..Hd.P.F.T...Z.O]....j.<.>*.<O+.m.>Pl..UA.,.......$.d..$..g.~.....s&.I...}.s.......w..B6.......Yy.F.vm.........1..6.Xp....v.....f.?..y..Xj....0.<..n.^....|..].Z...,........y....^....,.....f..Yf..\.54J,!pm.y......Y..w.?wA4.>0.............V~....{P.L..;...m..U./_m...f...."..rf#....{...l...%...... pi..6.S,}.G.z...56O..o..r...,=x....r.k..;0....U'Z..u.<..!.t8....g.....Z..7... ...../5.._...b....&....`J8>j..6X.g.c.e.t...ZfXj.:K.....Oxs..Q..&+l....;...[....}..|.y....#.#.....f.........Y...i;..K.d...........n.. ..=.1.*.....O[..Gl.G.@..X..-...\;....B.RK.1...........-..Z.....?.`t..).KO../_i...oq.=.:l...+>p..w.`..4\...)K..nK....._$.q:.=r...%+...R.jj..e.Y..|R...a....`z?6S.'.y...Z.-..O....x......$.{z,..Z..,J.c.....|..:...o.@.(..u.m~...l...s.[.1o..x...u.(r|...4qP.X2..:..b.(G.5...Y.F.r)k.o..]im......7.@.....z.Ew........e..L%.5c0.}.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\is-3V26O.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp
                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):27549456
                                                                                                                                                              Entropy (8bit):7.999862727155135
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:786432:Ub3ToDaC5U52NWJprv2ATAknQ+PsrPSXEZxLDW:Ub3kDaMhNWvrusbMSX3
                                                                                                                                                              MD5:4F45F9BD3CC4739BDC91A4D183C0DC01
                                                                                                                                                              SHA1:3AEA9C61B316547343F5E1085441883A781379E3
                                                                                                                                                              SHA-256:E0CBC854E5F0FC653C3E1E68988CC5E0AAB1F66A4B7264CB09F490A28439061F
                                                                                                                                                              SHA-512:A4665E71FDEEA35186A15C8C25C9369E394F6631BC830AC7F7EBB4E29D6479F9BFB54E9E54056CCA0DE256E4C10F5DAC51C1F473903D5F184F5B78C5DBA01CB2
                                                                                                                                                              Malicious:true
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 17%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L...5.oZ.................f...........4............@..........................@...........@.............................................,............7...'...........................................................................................text....d.......f.................. ..`.rdata...............j..............@..@.data...X............~..............@....ndata...................................rsrc...,...........................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\is-4K154.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp
                                                                                                                                                              File Type:PNG image data, 547 x 280, 8-bit/color RGBA, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):53151
                                                                                                                                                              Entropy (8bit):7.982330941208071
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:GcHlp3vMusTtWEgKqx8zHom+GChNPDViFKWUyG:Ggz3kTNgKq66VcFKW9G
                                                                                                                                                              MD5:AEE8E80B35DCB3CF2A5733BA99231560
                                                                                                                                                              SHA1:7BCF9FEB3094B7D79D080597B56A18DA5144CA7B
                                                                                                                                                              SHA-256:35BBD8F390865173D65BA2F38320A04755541A0783E9F825FDB9862F80D97AA9
                                                                                                                                                              SHA-512:DCD84221571BF809107F7AEAF94BAB2F494EA0431B9DADB97FEED63074322D1CF0446DBD52429A70186D3ECD631FB409102AFCF7E11713E9C1041CAACDB8B976
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...#............B....pHYs.................sRGB.........gAMA......a....4IDATx.......y...u.}...W."..(s ........p.........Q...?ql=...'.8....E.l...Y.-ah..FP.w.......__uUwuw.r.3X.z..........jcppph........O.appp..........n ..qph..88.......pd...y...!..888.##...._..C.8....Cn82...,.8...40....!7..qph..GF.2.........C.h....q#.........!7..qph.O..../_..p......B....K...`.XF.n}........S/b.._..?.XH.2q...i.}..y....c...8..b|~:WY...8....a......o...v..!.~.+8z...P.....y......2y^....!.w..C.=..'.J]..v. ..}./o..q....M...........<$.X.<)..g.gp......'.Y.I...'.x......D.(..C...m.. .:.#....$. .LdD.E...*..a..}..eih.A.....AyR...7a..2..N##DD^....Tg...;>$..tZo.....m......3.A..p....$MM.".hF.......qpX....7..F.=.k..e".G/...G~E.........4..kA.{....yN.dH)~.s...........#.W...lD.:..W}...#...kP.&...;....n......?..d....oH.....#..'a..s..D.....<.......h...y.....D..!.^...G....4.........c .;?$..6...@.....O c.......~.u...1.7......c.|..'...?/..#;.z&....T.M4.w.."....7W....

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\is-5PIPS.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp
                                                                                                                                                              File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):125405
                                                                                                                                                              Entropy (8bit):7.996684823256823
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:3072:U7Uc8cJ1YuWatSIyY6NCW23L2XEYL02BmusGPCeoDhL8oLvoLH:WJ1zWuSNYJWCGEK9BmPCkhfL4
                                                                                                                                                              MD5:56B0D3E1B154AE65682C167D25EC94A6
                                                                                                                                                              SHA1:44439842B756C6FF14DF658BEFCCB7A294A8EA88
                                                                                                                                                              SHA-256:434BFC9E005A7C8EE249B62F176979F1B4CDE69484DB1683EA07A63E6C1E93DE
                                                                                                                                                              SHA-512:6F7211546C6360D4BE8C3BB38F1E5B1B4A136AA1E15EC5AE57C9670215680B27FF336C4947BD6D736115FA4DEDEA10AACF558B6988196F583B324B50D4ECA172
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:PK.........XQW.a..............avg_antivirus_free_setup.exe.].|TG........Mj.RH-V..6.@.....Z.....%@-....;@K(..,..STPT.T.GT...H.%..*BBQ.6Z.&...4.wf.......OZ..........}.}l..,I...#.I........4I....GK.7...Z..........~...Og>..g>.Y_...,..&...HA.?....F..9...>.|.\sJ.....N.L~.OY.......)5.......;...,~7.&...LJ6?... ....w~.|.7.>..Kx..d.{J*./....j..>....."i...6..%..t.i.M.H...&...~.oV.qO...!Qy.)......&.8......I..../&I.83Y......%K%. .'Y..+I%?H.J."...g.&/)A...^...I.]..}.'6..l.%.../.?..W..1.cH.1..}<...'...G`..t"..#.<|.\...$x.9....\.....q..'6.U..Wi..u..`.X.+i..K./...O..p.............s.G........3y.Hz.V...=-.I..\)..}.S.WW$}.\I....n.H.IR.E.{...C0...s..X'.z...W.J.iL..........i...l..$..........A$=.2=...4[J6.(..l$....f....y.g...o..:m.B...$....&...".}.r{......n&./.xdBA~d.D.....5p....g..... _Z..-b...jg.o.wMA$.2...=..5.&x.....,?..MF...2QVO,V.N..........R.^..o..o..4.hd.H..LE.SBE,.8|Eo&d..D.Vq..NK.[.[.g.K.v..D".....og.m1....x..C....b..`?2...L...t..O.t.U..l..02.v.A.G2

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\is-IN5C8.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp
                                                                                                                                                              File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):527389
                                                                                                                                                              Entropy (8bit):7.995975187354872
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:12288:ib5kasT/hWZEu58IbccPqwozk/2rYJb69+J2W:M5kzT/hWZjfbccPOzk/aIb3J2W
                                                                                                                                                              MD5:F68008B70822BD28C82D13A289DEB418
                                                                                                                                                              SHA1:06ABBE109BA6DFD4153D76CD65BFFFAE129C41D8
                                                                                                                                                              SHA-256:CC6F4FAF4E8A9F4D2269D1D69A69EA326F789620FB98078CC98597F3CB998589
                                                                                                                                                              SHA-512:FA482942E32E14011AE3C6762C638CCB0A0E8EC0055D2327C3ACC381DDDF1400DE79E4E9321A39A418800D072E59C36B94B13B7EB62751D3AEC990FB38CE9253
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:PK.........\zX...............saBSI.exe.Z.pT.u.+i..eW c....&....l.....Y[...-@`....e.....;r.T...MJ3.a.]..h:.VF?.u...T...+..()..;...v..[v...........]....s......[..!.....A!?N..?%&!.....1...}AS...U)._t4.;z........9r....A..G...86l}.....EVk.J......t.[E....w...x..+Wx...gg.Qz>...f...8.q^.?..)~..o..B.!z...)....m.{7..F...w....O.+.l*z..].......I.......v..=....S.i.=.r..J.....!.xI2D...!.5..S..r...Rz..@`......Ol....]4..(......]..K..%.I,.8?]"..Y..k|...%.W.#.p....5.li....r.A.5-......X....B.e.J.s.9...s."..S.NE.Fq...D\...0!....v..../..{....sL(6l.E8g...G...!V......^..|.Dp.k....W-B9.."B-.-...h.(..4.9>..&.3.2<.V.x.|T...Ke}.b.G.&1...!..>..P(..2~....~...S....B.d.$......,...O..B9.`.....X}B......B9.`a.8..0....l..B......|..0.b....N...0....%.^.`..0....{...MY.....4..H.'......Il....(..&.e.:&.X=$...+..P..na...C.~]...n...2..n..a0.U...>.0..2.....`..4...<.0.e..a._f0...[.....2..i._c0..i.^....(.).G.|.....$....^.YR..R...<.`..*...l'@..2...V[..0..B*.s......2x...........`'.(.Y...\.`..$

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\logo.png

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp
                                                                                                                                                              File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):7150
                                                                                                                                                              Entropy (8bit):7.9457326012659095
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:Sv5m6xnZMfUMIQIOBujhx8a8Ui5ALQhTaCcOLKhAW2:Sh5xQPr3Buj/8a8ycaCcdAx
                                                                                                                                                              MD5:5078AAB74E06AA597E66D92C9DBFE5FD
                                                                                                                                                              SHA1:BB3E6F35064AFD74ED66334D042CE3E274116C64
                                                                                                                                                              SHA-256:597EF7036D93670839F088C50328673AE7B8532F276CAB6BB33F1FD2C568D7DA
                                                                                                                                                              SHA-512:31859CF708D799D2CA7D4489BF4552ECFB6DC42B31E4E6D646710409D640E0C93AA96CE12CF0E7E7E250D65458718CC05901E7209C13987DDE12AD608C13F68F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.PNG........IHDR...@...@......iq.....sRGB.........gAMA......a.....pHYs..........+......IDATx^....]u}....7...I2..B..Hd.P.F.T...Z......Z.U..G....V8....pXU.J T ....BH.$.0.d......~..{..e.`".?........[...x!d...b...V...[-|}....f.z...+..0.........)..g..Zt...S.<...7._....|...[...!.7<m..f..y..?/]eV.h.JGs.y.\.,3ja....%.........?..,}.;.1;...?0...L/....[i.........0...vH..9...K._........56EZ-...[....=.Y.....7Y.}84...K...y..e..?b.+.4........(.-....[..;.+..V....Z._z...^i..S....IGC..xn...\m...X0...=.G0k.....5...h..7.....S..+.[c..y......k.b..+-...2..+...H....VXs..w..,.g2o.rK...V..y.UW.......^&.....f.7.W[..YU..v.W..:....#V....p.-......!V....|...8fk8&..l.O=j..7..).& ...Zp....?..x...l............#C.N..]p..}.z.=.,x...Q.Q....[..,..6....NY..w[...8..."1..Yn.j.}.KVzy...?..l.k.g..y....... .....L.......km..{?a...Q...k2.#......7?k..~F.(..5x...:?.q..p..B...........iRW.y.c.w...?c..y.I$.(Q...I..i.D.d..u...#Q..k......R..i.R....>t.....o.."}..=......s,..k"7.L*jFa

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0 (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp
                                                                                                                                                              File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):527389
                                                                                                                                                              Entropy (8bit):7.995975187354872
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:12288:ib5kasT/hWZEu58IbccPqwozk/2rYJb69+J2W:M5kzT/hWZjfbccPOzk/aIb3J2W
                                                                                                                                                              MD5:F68008B70822BD28C82D13A289DEB418
                                                                                                                                                              SHA1:06ABBE109BA6DFD4153D76CD65BFFFAE129C41D8
                                                                                                                                                              SHA-256:CC6F4FAF4E8A9F4D2269D1D69A69EA326F789620FB98078CC98597F3CB998589
                                                                                                                                                              SHA-512:FA482942E32E14011AE3C6762C638CCB0A0E8EC0055D2327C3ACC381DDDF1400DE79E4E9321A39A418800D072E59C36B94B13B7EB62751D3AEC990FB38CE9253
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:PK.........\zX...............saBSI.exe.Z.pT.u.+i..eW c....&....l.....Y[...-@`....e.....;r.T...MJ3.a.]..h:.VF?.u...T...+..()..;...v..[v...........]....s......[..!.....A!?N..?%&!.....1...}AS...U)._t4.;z........9r....A..G...86l}.....EVk.J......t.[E....w...x..+Wx...gg.Qz>...f...8.q^.?..)~..o..B.!z...)....m.{7..F...w....O.+.l*z..].......I.......v..=....S.i.=.r..J.....!.xI2D...!.5..S..r...Rz..@`......Ol....]4..(......]..K..%.I,.8?]"..Y..k|...%.W.#.p....5.li....r.A.5-......X....B.e.J.s.9...s."..S.NE.Fq...D\...0!....v..../..{....sL(6l.E8g...G...!V......^..|.Dp.k....W-B9.."B-.-...h.(..4.9>..&.3.2<.V.x.|T...Ke}.b.G.&1...!..>..P(..2~....~...S....B.d.$......,...O..B9.`.....X}B......B9.`a.8..0....l..B......|..0.b....N...0....%.^.`..0....{...MY.....4..H.'......Il....(..&.e.:&.X=$...+..P..na...C.~]...n...2..n..a0.U...>.0..2.....`..4...<.0.e..a._f0...[.....2..i._c0..i.^....(.).G.|.....$....^.YR..R...<.`..*...l'@..2...V[..0..B*.s......2x...........`'.(.Y...\.`..$

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0.zip (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp
                                                                                                                                                              File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):527389
                                                                                                                                                              Entropy (8bit):7.995975187354872
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:12288:ib5kasT/hWZEu58IbccPqwozk/2rYJb69+J2W:M5kzT/hWZjfbccPOzk/aIb3J2W
                                                                                                                                                              MD5:F68008B70822BD28C82D13A289DEB418
                                                                                                                                                              SHA1:06ABBE109BA6DFD4153D76CD65BFFFAE129C41D8
                                                                                                                                                              SHA-256:CC6F4FAF4E8A9F4D2269D1D69A69EA326F789620FB98078CC98597F3CB998589
                                                                                                                                                              SHA-512:FA482942E32E14011AE3C6762C638CCB0A0E8EC0055D2327C3ACC381DDDF1400DE79E4E9321A39A418800D072E59C36B94B13B7EB62751D3AEC990FB38CE9253
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:PK.........\zX...............saBSI.exe.Z.pT.u.+i..eW c....&....l.....Y[...-@`....e.....;r.T...MJ3.a.]..h:.VF?.u...T...+..()..;...v..[v...........]....s......[..!.....A!?N..?%&!.....1...}AS...U)._t4.;z........9r....A..G...86l}.....EVk.J......t.[E....w...x..+Wx...gg.Qz>...f...8.q^.?..)~..o..B.!z...)....m.{7..F...w....O.+.l*z..].......I.......v..=....S.i.=.r..J.....!.xI2D...!.5..S..r...Rz..@`......Ol....]4..(......]..K..%.I,.8?]"..Y..k|...%.W.#.p....5.li....r.A.5-......X....B.e.J.s.9...s."..S.NE.Fq...D\...0!....v..../..{....sL(6l.E8g...G...!V......^..|.Dp.k....W-B9.."B-.-...h.(..4.9>..&.3.2<.V.x.|T...Ke}.b.G.&1...!..>..P(..2~....~...S....B.d.$......,...O..B9.`.....X}B......B9.`a.8..0....l..B......|..0.b....N...0....%.^.`..0....{...MY.....4..H.'......Il....(..&.e.:&.X=$...+..P..na...C.~]...n...2..n..a0.U...>.0..2.....`..4...<.0.e..a._f0...[.....2..i._c0..i.^....(.).G.|.....$....^.YR..R...<.`..*...l'@..2...V[..0..B*.s......2x...........`'.(.Y...\.`..$

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exe
                                                                                                                                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):29504216
                                                                                                                                                              Entropy (8bit):7.992759398379778
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:786432:04e7iJzW/sw/H8gbacchaQh0T1iWcO1Q3+Bu+:wiJusw/8gvc0C0prcObB5
                                                                                                                                                              MD5:E1DD69840A8965E125AA7F311B6D8EFB
                                                                                                                                                              SHA1:ECEBA8DA71B7A767C674BFB5E704AEA6857E0827
                                                                                                                                                              SHA-256:94F19254D9F0B4D11BD99E23CFD2ACFC4498BCCD1B163CA7BF4DC19FC303A088
                                                                                                                                                              SHA-512:4FA041DD7B6DCE8EE43D579BA0DC2E383A4B0CA3AEA56EE967C7FE5079647C644189A1E5C7BFE27375CC54E96DDB1ABEC5C56E91185C58BE977CC77D6A7C1913
                                                                                                                                                              Malicious:true
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t.K=0.%n0.%n0.%nk.&o:.%nk.!o".%nk. o..%nb.!o .%nb.&o:.%nb. oj.%nk.$o5.%n0.$n..%n..,o<.%n...n1.%n..'o1.%nRich0.%n........................PE..d....j)f.........."..........|.................@....................................t.....`.................................................8$..(............p..p2...........p.........p.......................(.......8...............p...H"..`....................text............................... ..`.rdata..............................@..@.data....1...0......................@....pdata..p2...p...4...4..............@..@_RDATA...............h..............@..@.rsrc................j..............@..@.reloc.......p......................@..B................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp
                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1184128
                                                                                                                                                              Entropy (8bit):6.623147525519113
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24576:WF66IUpqM/XAl0drYaL6NFEXXN6abiklqOYadJ0CbmpV4CsCa0wDisO4qG:k/M0drYaIaXXOAqOYadJ0Cbmrhq0wTb5
                                                                                                                                                              MD5:143255618462A577DE27286A272584E1
                                                                                                                                                              SHA1:EFC032A6822BC57BCD0C9662A6A062BE45F11ACB
                                                                                                                                                              SHA-256:F5AA950381FBCEA7D730AA794974CA9E3310384A95D6CF4D015FBDBD9797B3E4
                                                                                                                                                              SHA-512:C0A084D5C0B645E6A6479B234FA73C405F56310119DD7C8B061334544C47622FDD5139DB9781B339BB3D3E17AC59FDDB7D7860834ECFE8AAD6D2AE8C869E1CB9
                                                                                                                                                              Malicious:true
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......2..}vn..vn..vn..-../xn..-../.n..$../bn..$../on..G2r.tn..$../.n..-../on..-../wn..-../yn...../wn...../~n...../Zn..vn..=o...../{n...../hn....p.wn...../wn..Richvn..................PE..L...V..e.....................h...... .............@..................................1....@.............................................p...............................p...................@.......X...@...............0....... ....................text............................... ..`.rdata..............................@..@.data..............................@....didat...............T..............@....rsrc...p............V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1 (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp
                                                                                                                                                              File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):125405
                                                                                                                                                              Entropy (8bit):7.996684823256823
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:3072:U7Uc8cJ1YuWatSIyY6NCW23L2XEYL02BmusGPCeoDhL8oLvoLH:WJ1zWuSNYJWCGEK9BmPCkhfL4
                                                                                                                                                              MD5:56B0D3E1B154AE65682C167D25EC94A6
                                                                                                                                                              SHA1:44439842B756C6FF14DF658BEFCCB7A294A8EA88
                                                                                                                                                              SHA-256:434BFC9E005A7C8EE249B62F176979F1B4CDE69484DB1683EA07A63E6C1E93DE
                                                                                                                                                              SHA-512:6F7211546C6360D4BE8C3BB38F1E5B1B4A136AA1E15EC5AE57C9670215680B27FF336C4947BD6D736115FA4DEDEA10AACF558B6988196F583B324B50D4ECA172
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:PK.........XQW.a..............avg_antivirus_free_setup.exe.].|TG........Mj.RH-V..6.@.....Z.....%@-....;@K(..,..STPT.T.GT...H.%..*BBQ.6Z.&...4.wf.......OZ..........}.}l..,I...#.I........4I....GK.7...Z..........~...Og>..g>.Y_...,..&...HA.?....F..9...>.|.\sJ.....N.L~.OY.......)5.......;...,~7.&...LJ6?... ....w~.|.7.>..Kx..d.{J*./....j..>....."i...6..%..t.i.M.H...&...~.oV.qO...!Qy.)......&.8......I..../&I.83Y......%K%. .'Y..+I%?H.J."...g.&/)A...^...I.]..}.'6..l.%.../.?..W..1.cH.1..}<...'...G`..t"..#.<|.\...$x.9....\.....q..'6.U..Wi..u..`.X.+i..K./...O..p.............s.G........3y.Hz.V...=-.I..\)..}.S.WW$}.\I....n.H.IR.E.{...C0...s..X'.z...W.J.iL..........i...l..$..........A$=.2=...4[J6.(..l$....f....y.g...o..:m.B...$....&...".}.r{......n&./.xdBA~d.D.....5p....g..... _Z..-b...jg.o.wMA$.2...=..5.&x.....,?..MF...2QVO,V.N..........R.^..o..o..4.hd.H..LE.SBE,.8|Eo&d..D.Vq..NK.[.[.g.K.v..D".....og.m1....x..C....b..`?2...L...t..O.t.U..l..02.v.A.G2

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1.zip (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp
                                                                                                                                                              File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):125405
                                                                                                                                                              Entropy (8bit):7.996684823256823
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:3072:U7Uc8cJ1YuWatSIyY6NCW23L2XEYL02BmusGPCeoDhL8oLvoLH:WJ1zWuSNYJWCGEK9BmPCkhfL4
                                                                                                                                                              MD5:56B0D3E1B154AE65682C167D25EC94A6
                                                                                                                                                              SHA1:44439842B756C6FF14DF658BEFCCB7A294A8EA88
                                                                                                                                                              SHA-256:434BFC9E005A7C8EE249B62F176979F1B4CDE69484DB1683EA07A63E6C1E93DE
                                                                                                                                                              SHA-512:6F7211546C6360D4BE8C3BB38F1E5B1B4A136AA1E15EC5AE57C9670215680B27FF336C4947BD6D736115FA4DEDEA10AACF558B6988196F583B324B50D4ECA172
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:PK.........XQW.a..............avg_antivirus_free_setup.exe.].|TG........Mj.RH-V..6.@.....Z.....%@-....;@K(..,..STPT.T.GT...H.%..*BBQ.6Z.&...4.wf.......OZ..........}.}l..,I...#.I........4I....GK.7...Z..........~...Og>..g>.Y_...,..&...HA.?....F..9...>.|.\sJ.....N.L~.OY.......)5.......;...,~7.&...LJ6?... ....w~.|.7.>..Kx..d.{J*./....j..>....."i...6..%..t.i.M.H...&...~.oV.qO...!Qy.)......&.8......I..../&I.83Y......%K%. .'Y..+I%?H.J."...g.&/)A...^...I.]..}.'6..l.%.../.?..W..1.cH.1..}<...'...G`..t"..#.<|.\...$x.9....\.....q..'6.U..Wi..u..`.X.+i..K./...O..p.............s.G........3y.Hz.V...=-.I..\)..}.S.WW$}.\I....n.H.IR.E.{...C0...s..X'.z...W.J.iL..........i...l..$..........A$=.2=...4[J6.(..l$....f....y.g...o..:m.B...$....&...".}.r{......n&./.xdBA~d.D.....5p....g..... _Z..-b...jg.o.wMA$.2...=..5.&x.....,?..MF...2QVO,V.N..........R.^..o..o..4.hd.H..LE.SBE,.8|Eo&d..D.Vq..NK.[.[.g.K.v..D".....og.m1....x..C....b..`?2...L...t..O.t.U..l..02.v.A.G2

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp
                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):234936
                                                                                                                                                              Entropy (8bit):6.580764795165994
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:y2RaiKg4xmUh1WXHqw/l+qmOELhakVsm3mxB32tLEv8zfdn5f2dZLCoKOhh3K0Ko:y0KgGwHqwOOELha+sm2D2+UhngNdK4d
                                                                                                                                                              MD5:26816AF65F2A3F1C61FB44C682510C97
                                                                                                                                                              SHA1:6CA3FE45B3CCD41B25D02179B6529FAEDEF7884A
                                                                                                                                                              SHA-256:2025C8C2ACC5537366E84809CB112589DDC9E16630A81C301D24C887E2D25F45
                                                                                                                                                              SHA-512:2426E54F598E3A4A6D2242AB668CE593D8947F5DDB36ADED7356BE99134CBC2F37323E1D36DB95703A629EF712FAB65F1285D9F9433B1E1AF0123FD1773D0384
                                                                                                                                                              Malicious:true
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......v jU2A..2A..2A......9A......LA......*A..`).. A..`)..'A...(..0A..`)...A..;9..3A..;9..?A..2A...A..;9..3A...(..?A...(..3A..2A..0A...(..3A..Rich2A..................PE..L....m6d.........."..........\...... ........0....@.................................V.....@........................................................Hl..p)..........p...p..........................`M..@............0......T........................text............................... ..`.rdata..`....0......................@..@.data...............................@....didat..L...........................@....rsrc...............................@..@.reloc...............N..............@..B................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\zbShieldUtils.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2060288
                                                                                                                                                              Entropy (8bit):6.6115119989556215
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:49152:YwyBp/wFOX9xRo3HVCEd2ynjsfAXBpAK0A8BFuXAFotKLCs:YRDwIN3o3UEd2ynjsoRpAK58BFucE
                                                                                                                                                              MD5:CBDBBFBBCA6093D9DC462A59CCEA2713
                                                                                                                                                              SHA1:DF6C46FC6116FA0C773D6939EAD4D644DBD6097B
                                                                                                                                                              SHA-256:8AA3ECA63350A70CA97F39867F842DDCBB153254F58C0E97FADBDB528E2CAB79
                                                                                                                                                              SHA-512:F6284101DCC7450B472794DF5080C914581FFE2542FC3E873ECA4E47F5B4EF3C2985F46F8800326174A19961B40FA943724B85258A8DD0E99C58459D528AF26B
                                                                                                                                                              Malicious:true
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 5%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........./}..A...A...A...B/..A...F/..A...E/..A...D//.A...G/..A...@/..A...@...A...E/..A...B/..A...D/..A.%.H/..A.%.A/..A.%.....A.......A.%.C/..A.Rich..A.........PE..L...d..f...........!.....f...N............................................................@.........................@..........T........A..............................p...............................@............................................text....e.......f.................. ..`.rdata..NL.......N...j..............@..@.data............Z..................@....rsrc....A.......B..................@..@.reloc...............T..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BcNsisHelper.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):3208704
                                                                                                                                                              Entropy (8bit):6.634373076953411
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:98304:mEyWp/rW6xmOscLWpzDVuzDn8HKF2UfoEvlzbTpY:mKpccL1PF2Ufxba
                                                                                                                                                              MD5:48B932FF8C977E3991E959F824883AD5
                                                                                                                                                              SHA1:6E1BBF12BE0BABAC3EC6E30487AE0A66950E6B8E
                                                                                                                                                              SHA-256:764F9A8F8388D73AAB366D24645A49AE055318DB1F4FD88636E2B3A61AE95987
                                                                                                                                                              SHA-512:777875B3237442437BC3D9DF558F8D23825B618CF04BC07D3B8DD42A72A8FE09AFA20E6B31791FFA86A12B22D7395D419B250313306C41EE854AE62BC1FD9498
                                                                                                                                                              Malicious:true
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.........$..J..J..J.c....J.c.....J.c.....J.r.O...J.....J.....J......J..K...J...N...J...I..J...O...J.r.C..J.r.J..J.r....J....J.r.H..J.Rich.J.........................PE..L.....a...........!.....`$.........XV.......p$...............................1.....................................0.,.x.....,.T.... ...B...................p..x.....*.8.....................*.....8.*.@............p$.P............................text...._$......`$................. ..`.rdata.......p$......d$.............@..@.data...`....0-.......-.............@....rsrc....B... ...D....-.............@..@.reloc..x....p........-.............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BcNsisHelperXP.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):141824
                                                                                                                                                              Entropy (8bit):6.259166846082307
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3072:bjhPruBXUUxQvlfseJLtqfAg0Fuj9OMpTGpfD:nhjNUxW6AOHeD
                                                                                                                                                              MD5:378AE59FFAECECAC8627A35B42C74147
                                                                                                                                                              SHA1:BCFBE797416322662C2776F96E87BF217430F557
                                                                                                                                                              SHA-256:003EFD5E26C4E0338FB11B823D424F1C499C16391961C185F5F9A9FC71E56F82
                                                                                                                                                              SHA-512:105067A1AD250E8876715C8717FADE20D79575A5C594DC1899015979CFAF4A5AA8F983ACC73BBE23A953A962A1C4AA4955F2DD586AA3BB3A9D59C50D95345662
                                                                                                                                                              Malicious:true
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?#..{ByJ{ByJ{ByJ..JuByJ..J.ByJ..JfByJh$zKnByJh$|KNByJh$}KdByJr:.JvByJ{BxJ.ByJ:%|KsByJ:%yKzByJ:%.JzByJ{B.JzByJ:%{KzByJRich{ByJ........PE..L...R.\[...........!.........8.......J.......................................p..........................................x...h...........XA...................P..P... ...............................@...@............................................text...B........................... ..`.rdata..............................@..@.data...............................@....rsrc...XA.......B..................@..@.reloc..P....P......................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitCometService.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2682920
                                                                                                                                                              Entropy (8bit):6.8309434037236505
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:49152:k8NtOFS+g/q2/1upBe3ytP4VKpHThGZ7aM0KB4JRwTckxs8sLZ:k8NV/qloC6VKPGhB4Jz
                                                                                                                                                              MD5:AE7FBFF183FF30913EBEB38913E8CFAD
                                                                                                                                                              SHA1:545CF38E47318185E168F04A733C2E0B13119C21
                                                                                                                                                              SHA-256:F366F293905BE928918AD30A020FD369E139F64FADD4CEDFF9F9FA1E663E9065
                                                                                                                                                              SHA-512:BAF9D4EF6C607A15DC203321E3412043B446776F4E364EFDB856F804E889853BEBEEA8EA98B319ECA468E2EE8E305050205CB19F280C33427E39967E4CA9FFBA
                                                                                                                                                              Malicious:true
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.........)..zG..zG..zG...B..zG..zG..zG.I.C..{G.X..zG.X.ZzG.X..zG...D..zG.I.B..zG...B.kzG...C..zG.....zG.....zG..zF..{G.I.N..zG.I....zG..z..zG.I.E..zG.Rich.zG.................PE..L.....a.................L..........G}.......`....@..........................P)......N)......................................Q'...... (...............(.($...0(......h&......................h&..... h&.@............`...............................text....K.......L.................. ..`.rdata..T....`.......P..............@..@.data........p'..P...X'.............@....rsrc........ (.......'.............@..@.reloc.......0(.......'.............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):83256
                                                                                                                                                              Entropy (8bit):6.101042810707695
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:tCRIsR6gNFbzfv9i6Ix3RWCS35BrxOhG4ZcvblF:/sR9NFbzABxgCSkhG4ZcP
                                                                                                                                                              MD5:EDB96675541D0275C42096B64D794D3B
                                                                                                                                                              SHA1:D722C55EC62DA1866A6EF81072970117B85CF290
                                                                                                                                                              SHA-256:842DF63767CACB7AEDB75FB352C1505D518662E2E9DCA5A297515EBDAE093918
                                                                                                                                                              SHA-512:5C7C2E848C68F6168035DBFB834D31586D0CA1ABB16F220C617F9E36A87B6D4FF0A1AEF03A73D5313D8962C9BEFB1BDF3ED2A700EE3668DF948EC067E2B1D124
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........COs..Os..Os..h...Fs..h...^s...|..Ns...|..@s..Os...s..h...Ds..h...Ns..h...Ns..RichOs..................PE..L...3.dI.....................P...................@..........................0....../................................................................0..8...............................................@............................................text............................... ..`.rdata........... ..................@..@.data...0...........................@....rsrc............ ..................@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\System.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):11776
                                                                                                                                                              Entropy (8bit):5.890541747176257
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV
                                                                                                                                                              MD5:75ED96254FBF894E42058062B4B4F0D1
                                                                                                                                                              SHA1:996503F1383B49021EB3427BC28D13B5BBD11977
                                                                                                                                                              SHA-256:A632D74332B3F08F834C732A103DAFEB09A540823A2217CA7F49159755E8F1D7
                                                                                                                                                              SHA-512:58174896DB81D481947B8745DAFE3A02C150F3938BB4543256E8CCE1145154E016D481DF9FE68DAC6D48407C62CBE20753320EBD5FE5E84806D07CE78E0EB0C4
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 3%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr*.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L.....oZ...........!..... ...........).......0...............................`............@..........................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..c....0.......$..............@..@.data...x....@.......(..............@....reloc..~....P.......*..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\firefoxextension.ini

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1022
                                                                                                                                                              Entropy (8bit):3.4987034854146972
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:QTzyegmh3hFPvC6yffCHC6ywiCclC6yGCA/uwK60wwXYUC65wK60wTCa:kWEhxFPvcCcw0lcs/uwSwywSw1
                                                                                                                                                              MD5:DAA9B5DD2DE4F31D67C473518E0B5F27
                                                                                                                                                              SHA1:834A8CEB5C4553DD18A40C7768A2134D4E1A44E4
                                                                                                                                                              SHA-256:FCAA7249D9E038DFF7A327DE52987EC9C4F14E640F747F9163C274508876C5BF
                                                                                                                                                              SHA-512:F8A7241D6CB7C9D972862EC32FD6C7719836CB6B7E61B3B15CDBBADD7E90F1C9879575F30995939F611DBE6307FB8D66ED758B539DE1FA8D6A2297037D2C7F8C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:..;. .I.n.i. .f.i.l.e. .g.e.n.e.r.a.t.e.d. .b.y. .t.h.e. .H.M. .N.I.S. .E.d.i.t. .I.O. .d.e.s.i.g.n.e.r.......[.S.e.t.t.i.n.g.s.].....N.u.m.F.i.e.l.d.s.=.5.........[.F.i.e.l.d. .1.].....T.y.p.e.=.L.a.b.e.l.....T.e.x.t.=.L.a.b.e.l.....L.e.f.t.=.3.5.....R.i.g.h.t.=.2.6.5.....T.o.p.=.1.5.....B.o.t.t.o.m.=.2.3.........[.F.i.e.l.d. .2.].....T.y.p.e.=.L.a.b.e.l.....T.e.x.t.=.L.a.b.e.l.....L.e.f.t.=.3.5.....R.i.g.h.t.=.2.6.5.....T.o.p.=.2.4.....B.o.t.t.o.m.=.4.5.........[.F.i.e.l.d. .3.].....T.y.p.e.=.L.a.b.e.l.....T.e.x.t.=.L.a.b.e.l.....L.e.f.t.=.3.5.....R.i.g.h.t.=.2.6.5.....T.o.p.=.5.0.....B.o.t.t.o.m.=.8.5.........[.F.i.e.l.d. .4.].....T.y.p.e.=.R.a.d.i.o.B.u.t.t.o.n.....T.e.x.t.=.R.a.d.i.o.B.u.t.t.o.n.....S.t.a.t.e.=.1.....F.l.a.g.s.=.G.R.O.U.P.....L.e.f.t.=.3.5.....R.i.g.h.t.=.3.0.0.....T.o.p.=.8.9.....B.o.t.t.o.m.=.1.0.0.........[.F.i.e.l.d. .5.].....T.y.p.e.=.R.a.d.i.o.B.u.t.t.o.n.....T.e.x.t.=.R.a.d.i.o.B.u.t.t.o.n.....L.e.f.t.=.3.5.....R.i.g.h.t.=.3.0.0.....T.o.p.=.1.1.0.....B.o.t.

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\http_Downloader.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1113088
                                                                                                                                                              Entropy (8bit):6.605073214827898
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24576:lJGAfbL/zinmJsPil8CXKZ7VHxSIQokA5OKQmwBg7MdtKTAPK:3GKzihPfCYRS2Z5ImQqMdgTAPK
                                                                                                                                                              MD5:B57D15325636150EB138DA1AC7387524
                                                                                                                                                              SHA1:93E69B7281955E9F24253E2D2ACCEEB1281DF567
                                                                                                                                                              SHA-256:45FFC3DFC4F922AC5E461B54627F1A6407AE681C545D70DBEBDD18095933D886
                                                                                                                                                              SHA-512:919D3DF10953CB305BAF29A3C20B55CB8D97D98CCCA8EF5A23924552D8C8C0692A00726BE09379D2E847B8899C6C351CE1D4705F0F6DC8B07C99C92B745D2FD4
                                                                                                                                                              Malicious:false
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L..F..c...c...c...c...c...../.c.....[.c......c.......c...b...c.....G.c.......c.......c.Rich..c.........PE..L...\#mQ.....................\....................@.................................om.......................................q..x....p...#..................................................@...........@............................................text............................... ..`.rdata..b...........................@..@.data............b...t..............@....tls.........`......................@....rsrc....#...p...$..................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Local\Temp\nsrA1A4.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):87991281
                                                                                                                                                              Entropy (8bit):6.741041594589525
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1572864:IYmzmdPuL48eh9GFXD0uSsHnWtfA4f4TSGA:4JL48fS9
                                                                                                                                                              MD5:4FD35AEC3AA78371598FF17F27EE54DA
                                                                                                                                                              SHA1:3CE2BF8C879482F8A454E30E8D1199BCAAA27000
                                                                                                                                                              SHA-256:65390E572A2FDA16AA18524EB9FF3EEDC5878E094584E9FDC35CE800947DE851
                                                                                                                                                              SHA-512:E9078D47EC538BCCDB5FEDBC6F5F8ABCEF9A79A4B9FDD9677515CB28EBC4AA78B84B99ED2B6271A0D4B5837AC117F76E216AFCCF0FEB4C52B0E0398DE088CF5A
                                                                                                                                                              Malicious:true
                                                                                                                                                              Yara Hits:
                                                                                                                                                              • Rule: JoeSecurity_PrivateLoader, Description: Yara detected PrivateLoader, Source: C:\Users\user\AppData\Local\Temp\nsrA1A4.tmp, Author: Joe Security
                                                                                                                                                              Preview:.M......,.......l........l.......>.......-.......M......................................................"...................Q...6....... ...................................................................................................................................................................E...................C...............................................f.......D...S...^.......#...................%...................f......._...n...y.......#...................%...................h.......z...............#.......................................................................................................g.......................#.......................................j.......................#...........................~...................................}....................................................... .......#.......|...........................................|...........................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Roaming\BitComet\BitComet.xml

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\BitComet\BitComet.exe
                                                                                                                                                              File Type:XML 1.0 document, ASCII text, with very long lines (5231)
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):6180
                                                                                                                                                              Entropy (8bit):6.076845987118915
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:Vk85a4vebdclXyOnfU7Pk61rz/HzZx1L+X:V7DWbOlXwzkOrTHzT1L+X
                                                                                                                                                              MD5:AD00448D2C57E602670191CE7AA3DD1E
                                                                                                                                                              SHA1:B48AC1EA733E739C4A6BEAB67DD4242C86BBB4D8
                                                                                                                                                              SHA-256:5A6539E412D53AD3C6BE5E8CDFA865481ECDB3BB92725141B8ABB680CEDC4136
                                                                                                                                                              SHA-512:CDF55E19945893CDED4ED18A0607316D1BF499BA15465F2D0762A9207E2707EA50C8344FBBFAD7B4D78E73B01AEFB70FDC097E37A9D37525A1807FB09C17CE02
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.<BitComet>. <Settings>. <SystemTrayHandle>67790,150</SystemTrayHandle>. <ClientInstallID>ae7b79c1d0de3420440a531a8fc59151</ClientInstallID>. <LastAdCacheClearDate>19922</LastAdCacheClearDate>. <AddIEContextMenu>false</AddIEContextMenu>. <CaptureIEDownload>false</CaptureIEDownload>. <ListenPort>9652</ListenPort>. <EdListenPort>8325</EdListenPort>. <EdListenPortUdp>8325</EdListenPortUdp>. <LastAutoUpdateCheckDate>1721338009</LastAutoUpdateCheckDate>. <ServerListNew>gO64/jY0V3QqeRNB9/4pbvM/8dHux533nB5ypavCFyMxC16kuoz3Th6dSl790j0yql/eTXj3BQAHitXwBW2b/oXVWGgr3Of3NkFw6r73mH1kwR+0Q8stAz4fDogQZKZrj8RcAv2ffyw3O4z2O/3dI8CxrDRjWtVdIpBFeNaxdOglbhst3K1dVyM8QLUMz6ZUK83aSdjDcxD68RrSMQR1/s5ouIT8xXMNZhwmKQtAI94x85e9wXYJWTGWJrcyPgQhayb4EB/FHL97fDpZxCzPF/Y171PinFrq27mnnOVYsWQHUNbQ2D5oiek83oJD9XvihXztt3BuPXLcFGK8ph/nVnm8Z/voeViOeodEAkAF9DQjwn7rAoF2yhsSMGgrLVFAhJ/Lu+h+dYWx1kPO/ur/VaAGXgmc+c5N+b97ZQMDQuyCYIeZsVYvh64LzYBAE

                                                                                                                                                              C:\Users\user\AppData\Roaming\BitComet\Downloads.xml

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\BitComet\BitComet.exe
                                                                                                                                                              File Type:XML 1.0 document, ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):125
                                                                                                                                                              Entropy (8bit):4.900623014258395
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:vFWWMNHU8LdgCaOELAz7q1DIXLRoJAbNHVgRNKOwK/IMn:TMVBd6Ojz78woObVVgeO/
                                                                                                                                                              MD5:5DB5CCD6C4AA219DD3832B7A6A318DF0
                                                                                                                                                              SHA1:C4E54D81A8BDE5CCFC817C7BF6B55DF3B28B0425
                                                                                                                                                              SHA-256:D2455B7F0A848A8A7931F31F8475AF3FD6761C0ACC4EF8D8EE1C9AD82CF47E57
                                                                                                                                                              SHA-512:1A63BBCE5E0CDDC7EBE2B47C87303304A4850E9057989E1E07E70261D891EA604A289ACE9F4FA850436D34D70B16B518B24C46759F0A220DFCE88B84341779BE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.<BitComet Author="RnySmile" Version="0.1">. <Torrents/>.</BitComet>.

                                                                                                                                                              C:\Users\user\AppData\Roaming\BitComet\Downloads.xml.bak

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\BitComet\BitComet.exe
                                                                                                                                                              File Type:XML 1.0 document, ASCII text
                                                                                                                                                              Category:modified
                                                                                                                                                              Size (bytes):125
                                                                                                                                                              Entropy (8bit):4.900623014258395
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:vFWWMNHU8LdgCaOELAz7q1DIXLRoJAbNHVgRNKOwK/IMn:TMVBd6Ojz78woObVVgeO/
                                                                                                                                                              MD5:5DB5CCD6C4AA219DD3832B7A6A318DF0
                                                                                                                                                              SHA1:C4E54D81A8BDE5CCFC817C7BF6B55DF3B28B0425
                                                                                                                                                              SHA-256:D2455B7F0A848A8A7931F31F8475AF3FD6761C0ACC4EF8D8EE1C9AD82CF47E57
                                                                                                                                                              SHA-512:1A63BBCE5E0CDDC7EBE2B47C87303304A4850E9057989E1E07E70261D891EA604A289ACE9F4FA850436D34D70B16B518B24C46759F0A220DFCE88B84341779BE
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.<BitComet Author="RnySmile" Version="0.1">. <Torrents/>.</BitComet>.

                                                                                                                                                              C:\Users\user\AppData\Roaming\BitComet\cache\post_info.db

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\BitComet\BitComet.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3007006, page size 1024, file counter 2, database pages 4, cookie 0x2, schema 1, UTF-8, version-valid-for 2
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):0.97656941552763
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:HLG06RJB6LGqPRBmnEHOR/0FqFB89wBQJLdyQ8wsQKXwVh:r0FbqPQEuD8wB8LdyQl8Xw
                                                                                                                                                              MD5:02F01CD119BBA40C635BA49995B465B1
                                                                                                                                                              SHA1:AEDED21F5B475DAA006FFEF2FA2E5B2C0669566C
                                                                                                                                                              SHA-256:F274381F54DC33B8B619F08F99CBF09A81B8813AD7C701467E18B3AD85A9B13D
                                                                                                                                                              SHA-512:32AE540C35DF723264BA937D2A4CEC3A96ED8363BB9AF891A1A50D60F421EA39E4CB7842C6919D652221D17898CB72CCC9A06447062BCA9463764CCC9AC4B674
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:SQLite format 3......@ .........................................................................-.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N......qindexidx_datetaskinfo.CREATE UNIQUE INDEX idx_date on taskinfo (task_id).a........tabletaskinfotaskinfo.CREATE TABLE taskinfo (task_id char(56) primary key asc,expire_time_utc datetime not null,posts int not null,rating smallint not null,votes int not null,snapshot int not null,popular int not null)/...C...indexsqlite_autoindex

                                                                                                                                                              C:\Users\user\AppData\Roaming\BitComet\cache\post_info.db-journal

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\BitComet\BitComet.exe
                                                                                                                                                              File Type:SQLite Rollback Journal
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1544
                                                                                                                                                              Entropy (8bit):1.8912322955627912
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:7+tDl9+LiuF0n/l5EHOR/0FqFB89wBQJLdyQ8wsQKXwVhQ:7+tDL8iuw5EuD8wB8LdyQl8Xwg
                                                                                                                                                              MD5:A032165C4861722BDB91E74C407692DF
                                                                                                                                                              SHA1:3190BD869C142069C6DBA0D852B2D8CB8D417FA9
                                                                                                                                                              SHA-256:304C968BA69579651ACF6FCB974E4D8146E0C358BEDA4D5F24302DF49CE41536
                                                                                                                                                              SHA-512:AA4432113AD78B7F35A6C41E7FFEB2EC213DFCB4D00D8BAE5CC78FBC269FA5A47FB51AC4FE8883507C4F757785DAF58B161E1002E30E8BE1D12CF5A8BD1FF87F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.... .c.......(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ .........................................................................-..................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Roaming\BitComet\fav\HowTo-AddYourSite.txt

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2102
                                                                                                                                                              Entropy (8bit):3.7114563807036225
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:tVoUAcEEhNy5E2/zouWe807ZUJbDOEjydnsmM4QJ0QMlX1ZvwTfI41zZ0:tuUAcEEhI5E2/zouWe807ZUJbqEjydnn
                                                                                                                                                              MD5:BCB8FCFD9F2895DBA661D9D6A2C7E104
                                                                                                                                                              SHA1:2022C57946DD3C6061F1340E09069F0601EB8668
                                                                                                                                                              SHA-256:64977EE1C99F4F74FD196814736745E30D23D57A0E9F40AE80DA9AC4061C5F78
                                                                                                                                                              SHA-512:01680C5D380AD8F226E359627B2A1B8412FEE43E0301BA35AF224EAA31E6CA92BF3FB0B86E22EF95F242ECF63D4C3865D1BDDD99709A22B6920D2C1D8FFC6586
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:if you would like, you may add your favourite site in your language to fav/fav_xx_xx.xml file, and mail yours to bitcomet@yahoo.com.... Language -> Favourite File Name..==================================================..Albanian -> fav_sq.xml..Arabic -> fav_ar.xml..Basque -> fav_eu.xml..Bosnian -> fav_bs.xml..Bulgarian -> fav_bg.xml..Catalan -> fav_ca.xml..Chinese (Simplified) -> fav_zh_CN.xml..Chinese (Traditional) -> fav_zh_TW.xml..Croatian -> fav_hr.xml..Czech -> fav_cs.xml..Danish -> fav_da.xml..Dutch -> fav_nl.xml..English -> fav_en_US.xml..Estonian -> fav_et.xml..Finnish -> fav_fi.xml..French -> fav_fr.xml..Galician -> fav_gl.xml..Germ

                                                                                                                                                              C:\Users\user\AppData\Roaming\BitComet\fav\download-complete.wav

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:RIFF (little-endian) data, WAVE audio, Microsoft PCM, 8 bit, mono 22050 Hz
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):24637
                                                                                                                                                              Entropy (8bit):3.5384978461622847
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:VBUP1MtsT0rT7ulrrruuiH2aFCuuuuuouuuuuuuQ:VEpArT7ulrrruuiH2aFCuuuuuouuuuuC
                                                                                                                                                              MD5:8980AFEA02E229237A12725D4671F5C4
                                                                                                                                                              SHA1:2845431B8FDD8A228C1D52E11D95CCA96E9455A7
                                                                                                                                                              SHA-256:3DCF2568E492A62F91C6C9BBCFD7F1A12AA272FCA37B2A7EC7D68AD40BD462B8
                                                                                                                                                              SHA-512:381F5B9E31AEB6CE5162C0DAC392E9A14D4996A21A483C647344EB23893C45F60D388550237E1D879D470ACCD9F0FC844DA7878A14E8D5A9955510B76E4FF133
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:RIFF5`..WAVEfmt ........"V.."V......data.`..}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}{xv...oQ]...yU[}..ab...\Bb..wOa...k@I}..fZ...l?K...e\...o<?t..wd...o@E{..wk...hBU...ok...`?Z...m]~..b@\...mRr..bD_...rNd..eMh...hPn..`Ru...YOu.._T{...POx..bR}..|HEu..lY~..xB>n..w^~..uCBt..}cw..xDDy...W`...LGx...V[..zLL....SU...OP....OU..{QX...rFT...UX...sEO...^Y...n@O...eU~..qCN...gY...dAY..._U...hAU...iSx..gE_..._U..._Eh...Z]...OM~..wOa...QL|..{O\...PS...oI_...PO...uL^..~R\...dIi..vL\...bIj..rMf...ZFn..rMd...\Cf..{Rb...XEl..xRe...SDo..zSc...RFs..|Ra...TFr..}R`...RIw..~OX...YFn...RS..._Hl...RO...bIk...RN}..gLk...QO...hLm...NP...eLl...NN...jLh...OO...kKg...RN~..lKe...RM~..mKc...SN~..oI`...UM{..pJ`...UM}..oI_...VM{..qI]...XLx..rJ\...XLx..sJ\...YKv..uL\...\Lu..uL\...[Ku..vKZ...\Jr..xLX...]Ir..yLX..._Iq..zMW...^Io..{NV...`Jo..}NU...aJn..}OU...bJl..~OU...bIk...OT...dJk...QT...eIi...PR...fIh...QQ...gIh...RQ...hIf...RO...hIe...SO...kId...TN...lIb...UO~..kJb...UM

                                                                                                                                                              C:\Users\user\AppData\Roaming\BitComet\fav\embed_bcfs.zip

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):44574
                                                                                                                                                              Entropy (8bit):7.993583474935827
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:9yyESZ8/ADofafP0oqU/jIRx4K7cmP0j0p/Ch2/6RBA6G5AUEg/+z4V/vXxrx/Lf:UyESZ8/ADdMBU/jIXF7LA0pGJRCDtEFI
                                                                                                                                                              MD5:1456A3A00888B3546106577143BAF1B4
                                                                                                                                                              SHA1:AD15A91CB105B5D0ABB41E479082BE94E566B85B
                                                                                                                                                              SHA-256:2F116A7431EF22C544EDC1F7151895C095E0D23C261717779AACCE50C274F92D
                                                                                                                                                              SHA-512:B78D84A759200F100CC3F779CA06CA2D173D85DED018FE5DFD34B71649A83EF5A2908DE447F0B4B991260E2B1B4625B01005A2E927FAB47289818B7FB1612BB4
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:PK........EVpVf........Q......assets/index-0ce97892.css..Yo.D._a.*5hm|.9....$.......{..:..A........H...C.'........L..[m.6+8[....&{0...8.6Y.....Z~...j..U...._.Y.G..fIV..(xZ}...`...[ZA.....}uH.$N....n_..._..|s.Wf..*.A.K]..o..!....aV..u[..[.....89...,..4K^.[V....:ff...7..}...}...R.3.....}...6Y...y....00..5g..q....c|..Yg..?B............V...m.{<l.....zc..<......4+.Ar.d.9...N.4]E....N........FY..ri['.8..M.......*......#.aV.U...:..8..eU..S.N{..]...~..>....N.e. .}!....p....U....K...l..,..n....9......Y..!g.~..|6..:....O...(.3.I....%.2.p1..(D.E....{.Zk..~8.`..#..9.5p]......l..geL..<.)....x.^..A....&(9.Aj.....V...0'...C.[.>...b.NZ...W..&A^..p..@=eq.....jWdu.`z.V.......mI...B>g.s.<..... .0R.#...*`!na..BI[....9._4~....R...!.~V....@*.+1j...;.8...h.<...E.`...+.X.,....n..B1WA]e.Y.`........ .....v.c.\..j%...)..<NM)....}.....)=....J.J..<..{3.nAq+...:,....9&&...lc..u.dA$y...r.v.......Dq.'.q..%h..7.$Yx.k.U.E.."6.<l_.m..as..@9....3....O.F. f..;.npv.....<.]...u

                                                                                                                                                              C:\Users\user\AppData\Roaming\BitComet\fav\embed_bcfs_full.zip

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):44917
                                                                                                                                                              Entropy (8bit):7.9926926144744455
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:xjGH8i/nwu9VzeW7QaTh899kmwwpD+0clV9MUHAHitDnJzarsHciw3NCyAXGZHdJ:xav/nwi5T9Yubwvcr9MUHUitDn9ysHcD
                                                                                                                                                              MD5:8679541496E183BAECF4B68D10BECD6B
                                                                                                                                                              SHA1:7A20A53636D6B2D1DAAFB41E08526FEEB43DDCD1
                                                                                                                                                              SHA-256:034CFB415E84B49013EDA926BC562F76B5C36DE2A7E6E7C8622690B2BC595B4C
                                                                                                                                                              SHA-512:5A242AE65D7B104AD33634D129B22AFBA6F0F3C6AF38CA84300A9670E691DC2C0357023B3A88E68107FBE57EC89F8203370C8CEAEF8B997743FA8E43FA13DDFA
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:PK........F..W8.#Y...}.......assets/index-2f1e175b.js.].s...+......7.F.v.$>.;Nb.Ui...P.JR..[...vqRr^....... .X,......|X.E...."..gu<*......I-.2IOA;K.o.S..CZ..t...u...fEYW~:hO..<.3T..Q;.KY..;..@.S=+..lW...rq*39..r'._Po}...4u..4.Ta7.w...uB.._U...._=.>....i..3..q{x.f#.@;t.3.Xt..H......S'..d..|88z....h.xnB..2..e.).....x..E.-Q..RJ$.a...Y..<hp.eW!.Y.I.ZN.^ln..{...PT.i,.R.."K.\.f.pV.R....EU.e:Is.../0.#..&Y.....1n..0..d;Z{3.|1-.....nG+..0.B.....b.$,`.....Z.t......4.cY..Q..c.E.\....2..6.....94....,.E..N5.RP.h.L...=.[..e..d>......a./...%`0.R.@`.V.:u...nR. ..L....-..A..[^.K.g.>.....O].@..KQ.c..ao..ot[.o....4..._\...,..K.U..G.._gK~...\...Y..n.k...\../a....#+....|..J..._.._......W..!.....M.Y...(2.n....,.`.{..2._....z.k...k&..6H..l]v.2...q..6.D..v..X.<.$h...B.......g*.....!.......v..v,6..4#2.WT...[.. k._gX^..V.b&E.e...tZ.fe...4/n.,...EZM......W....y.h.Y.c.\g..Z.6T...||d......).+.OOF(.u.k.#B..#.... .S..O..E...z..a....Q..t..B|W...H...<.<.W,8...AZ}.....;..

                                                                                                                                                              C:\Users\user\AppData\Roaming\BitComet\fav\embed_bcsp.zip

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):67932
                                                                                                                                                              Entropy (8bit):7.993759003642842
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:1536:ZTAoQpBCvRAkPu9BL8KEoOl/Cz4/r+MVc93E5rYT:Zk9BCvSkPSN83ll/n+MaixYT
                                                                                                                                                              MD5:65EE73374475CE1FA2BB13EDBB8BF1E1
                                                                                                                                                              SHA1:DE3459AEF1F1585BEDE131AA27746E8649E33BEB
                                                                                                                                                              SHA-256:4929DA5C79350F943CD566B90B6F3B7875BCACAF98A9A51E79BFAD89802658B2
                                                                                                                                                              SHA-512:AFA4DA8ECD64164A46CA8A6502FDCB7AA55CC6F213F17360EAE7281E0F3B90FD10BD807BB081D53EE7159D80208C3EBBA07AD80B9C8F3ED37AA3242657B590DF
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:PK...........V.%.......\......assets/index-3eb59835.css..Yo.D._a.*5`.;W.G ..@..@< ...{..:...6X.33{..E.)...Y....3.kz+.Nsfz..dy.J..".5J6.*.C.[.Y..(,..#.E...W.q.JP..i..U..........U>A........m...8J..e.f[z.=[ZOl...V.K.Y~.sU..qn.....*..a...J...........^.Y...V..hm...d;..L...Y.`~..<|...Q.sx...mRf|...m.J...........U..8.....0.w@.l....H. 9.......%9.P....U..o#..;b../.......^..;?>..p_..|.%... .d.l..m^s..IA.#.V....=...*............-}.,Hs.....x..4.,Y.<..u....N........q.+....._.X........dS7..\..C...|X...]ff9.;..K.......}.5<[.M....5K.......i.F...W....@!..#..]<...R..e.C.:..s.wn.E.\WY.z7..T..."...,.!....h.....&.V~....V.@.......D.chb..#f5./..$...50...y...zbFIV.f...<.2..gAi"a?g~S....!9..,.c...3?.1R9.#...[..#..G.Q....>c.........l..vQ.FZ<F.....y......p.I(.E#e>..&2......(b..*r`.N.....U..d..6.A.!..[?L...Y.n..>.q.......s.%......m.....1{.k...=.u..8\..t...y.8{n..I4\.OLHE... .WY.......h......a_.Q.......P....4x..JKf....f/...\G...'...a.h.0.z..b.aIXk...*6w,.j...E>.!KU.3...

                                                                                                                                                              C:\Users\user\AppData\Roaming\BitComet\fav\embed_bcxt.zip

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):59284
                                                                                                                                                              Entropy (8bit):7.995077148269018
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:1536:OE/z9k630A9PpdbC63uiNG2D+a93AvjAvlp4wjGE07ySrDreIERjBR:z9f3VDui02D+s3dj0bZERdR
                                                                                                                                                              MD5:71177CAD5DF18CC2CFEF61BA03602474
                                                                                                                                                              SHA1:F836EE14957BC75ED4006501926419571751D695
                                                                                                                                                              SHA-256:60B859744F4C3011C5093D6DC1D1E9DB04964E89CBA6134CC0A659661AE28DB3
                                                                                                                                                              SHA-512:053DA12833CD1CABB282D2C4A005AA7443DEE4DD9EE960C392BEF21223CAB99CC5CBDAFF1D87BC64DC044992B19D6EE73E586E5AF76486257657561CD398B71C
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:PK........`.TV...u.....\......assets/index-0200434c.css..Y..4._.@+}AIh.c..@....<.x@.=...M..cwKT~;...."....3.x<........t......y.N..".=J..:.C...Y...QX...l..!.~..Q(AA....TyN..s.8v&.....%%t....;..}\.QB......w...~.....K.T2~.M._..........%Y#....j...<.....W.].....G..8.%..Ud.$.bjs...pr.-.~..0...nSj....}.N.........b|G+j}.G$...........)#m.../...{.{........:.........J.*.@.,a{.?I.=...4<.{.o....).(....q....x. ...V...[7{:..:....}.s..1}k...i........4.,i.:..s..g..nf...nQ....+....^..[.w'R..VQ.i...D@...1HCj.C.}fe9.;..O...H@.....~...m.....&qj.....y.....&ZS>..(......."...s..X...5.Mn.E.\WY.z;..[.6.K.......|....3-.m.G.._...!.Z..a.{.v.9..h..C...>bZ..".........$+./....PO.(..J.r..Uf..4(-F..4e.H...!.m...w.V){F.y...H...V.`....0.D..sy..G..V.r.6%. .}T.....%@*.>..Z....8...p..0..DF{..|r.=.&.."...*.2}R..@V....le.}....#.....x,...}.-.H.c.....8....^.s!V.k.v..gB.D4.W.{;.l@p..eO..8..i.....1..<p..)..o..G.Q.^T{P.C.FE....G.H..5_.ip.[....c+....v......N..H.:.:am....tK......Ul.iR.lv<....4U.GN.

                                                                                                                                                              C:\Users\user\AppData\Roaming\BitComet\fav\fav_en_us.xml

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1329
                                                                                                                                                              Entropy (8bit):5.020282734796359
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:24:2dF/mGMnIqYCXyR+4/j5IVbRGr00bhR/ZaxUHzNLJnxIHBUXjXR9v:c1mGMnZtXSdj54c00b0Ulahiv
                                                                                                                                                              MD5:D5261EED2AD6A3D575A41AD04D2A642E
                                                                                                                                                              SHA1:60078784E7461174527A76F4ED5347E2C52389D9
                                                                                                                                                              SHA-256:7FFC245B285B07D908EE24DBE0861D97BCBC5529F513A8BBDE4E5AB318D6BA74
                                                                                                                                                              SHA-512:3C1011137729EF6E121F1E1CE241CF045ECB4467A77AA3CE12EDEC271CCD1193F989CBCE3F298ED62358AE08799765CDED9ECA204B90CA77D3507185348DF8A5
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:<?xml version="1.0" encoding="utf-8"?>..<BitComet Author="RnySmile" Version="0.1">...<Favourite>....<WebSite expend="true" display="Torrent Sites" infotip="Browse Torrents Sites...">.....<torrents type="url" value="https://thepiratebay.org/" display="The Pirate Bay" infotip="" />.....<torrents type="url" value="http://www.torrentroom.com/" display="Torrent Room" infotip="" />.....<torrents type="url" value="http://www.torrentbar.com/" display="Torrent Bar" infotip="" />........<torrents type="url" value="https://www.demonoid.pw" display="Demonoid" infotip="" />.....<torrents type="url" value="http://www.sumotorrent.com/" display="SUMO Torrent" infotip="" />.....<torrents type="url" value="http://www.btmon.com/" display="BTMon" infotip="" />....</WebSite>...</Favourite>...<SearchToolbar>....<PirateBay title="ThePirateBay" link="https://thepiratebay.org/" html="http://www.bitcomet.com/client/redir/?https://thepiratebay.org/search/${QUERY}" />....<TorrentRoom title="TorrentRoom" link="htt

                                                                                                                                                              C:\Users\user\AppData\Roaming\BitComet\fav\fav_ja.xml

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1686
                                                                                                                                                              Entropy (8bit):5.341532937920971
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:c1mGMnZtXSdj5x4wpWRp7K8c00b0Ulah1:zztRp44L
                                                                                                                                                              MD5:5117FCC505C388208F77D733D372E988
                                                                                                                                                              SHA1:78DBA00D3554940BC8DE3A24E7D11CC0332902E6
                                                                                                                                                              SHA-256:F736CED207698F75A8EFEF131A43204B6144A8C9DABF430F988B6F379899697E
                                                                                                                                                              SHA-512:27B8AFD559EEBF033FB96A735333AF215DA71FF9D86E5AC58D0F99964D2726C3BFAF856221C6E7BB355882635FF66AB5EA3FEF498B1C3C2277C491E891885CCF
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:<?xml version="1.0" encoding="utf-8"?>..<BitComet Author="RnySmile" Version="0.1">...<Favourite>....<WebSite expend="true" display="Torrent Sites" infotip="Browse Torrents Sites...">.....<torrents type="url" value="https://thepiratebay.org/" display="The Pirate Bay" infotip="" />.....<torrents type="url" value="http://www.torrentroom.com/" display="Torrent Room" infotip="" />.....<torrents type="url" value="http://www.torrentbar.com/" display="Torrent Bar" infotip="" />........<torrents type="url" value="https://www.demonoid.pw" display="Demonoid" infotip="" />.....<torrents type="url" value="http://www.sumotorrent.com/" display="SUMO Torrent" infotip="" />.....<torrents type="url" value="http://www.btmon.com/" display="BTMon" infotip="" />....</WebSite>....<HomePage expend="true" icon="4" display="BitComet ......" infotip="BitComet...............">.....<BitCometHomePage type="url" value="http://www.bitcomet.com/" display=".........

                                                                                                                                                              C:\Users\user\AppData\Roaming\BitComet\fav\fav_zh_cn.xml

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):255
                                                                                                                                                              Entropy (8bit):5.406511758752926
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:JiMVBdYwoObVVgOnN04TNI4xKRQWYRJ4yhuG7ixKRQ:MMHdFb/ceC4MR0buG75RQ
                                                                                                                                                              MD5:9AD69127D67064E26875DBE67648A9AB
                                                                                                                                                              SHA1:7B32A8E84FFD9A88743DCF16FC8F57DF9320A363
                                                                                                                                                              SHA-256:E97923A042E30CC5E7B074948ED3F421BFC2C06E661399517BDCCF692D3D58B0
                                                                                                                                                              SHA-512:8FEEAE299C507D160195D4D70CD16662830EBFBEADBB533F98AA7ED540FEE82D869A4ED96F746E30E3BC471B1D046EE212EA64AC8A33A433D7DB1A7079A6AE56
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.<?xml version="1.0" encoding="utf-8"?>..<BitComet Author="RnySmile" Version="0.1">...<Favourite>...</Favourite>...<SearchToolbar>....<s title=".." link="https://jprj.com/" html="https://jprj.com/search?q=${QUERY}" />...</SearchToolbar>..</BitComet>

                                                                                                                                                              C:\Users\user\AppData\Roaming\BitComet\fav\fav_zh_tw.xml

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):296
                                                                                                                                                              Entropy (8bit):5.409903425816016
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:TMVBdY5HJFMVVgOnN04TNI4xKRQWYRJdiK53LKFhrG+9VfM9RqdxKR9v:TMHdu2/ceC4MR0/3whrG+32qmR9v
                                                                                                                                                              MD5:E833111D6C329F1CD7E1023683DDD685
                                                                                                                                                              SHA1:8D147C2F2DD3F29982167B168160BE71CAB1040C
                                                                                                                                                              SHA-256:882C77B9B177ABA77FC37A488D14C9B77E72E118B22B0813E2B6DE3830F2E1A8
                                                                                                                                                              SHA-512:CEEC6AD3034D06760DEC1E9ECB688A82D172901D0D29B03319775F93BAE58D3C964A48B9B5D15E78E12981CFA5B70D32940257825AC7B02AFE64F0FEABF47D22
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:<?xml version="1.0" encoding="utf-8"?>..<BitComet Author="X-Ray" Version="0.1">...<Favourite>...</Favourite>...<SearchToolbar>....<s title=".." link="http://tw.yahoo.com/" html="http://tw.search.yahoo.com/search?fr=yfp&amp;ei=utf-8&amp;v=0&amp;p=${QUERY}" />...</SearchToolbar>..</BitComet>..

                                                                                                                                                              C:\Users\user\AppData\Roaming\BitComet\fav\passport_info_en_us.zip

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):33174
                                                                                                                                                              Entropy (8bit):7.886948258995984
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:REMbqKGjL8bCgMpyonxzVhDNtaxVq2WvUEMbqKGjLFp:Rl/GjtbnThDNtaxVq2WvUl/GjJp
                                                                                                                                                              MD5:B6ADF0D4F826A82B6902AC9E0EB71E9C
                                                                                                                                                              SHA1:635388C1B0D1BF2674D4D1A1B35F817625734B99
                                                                                                                                                              SHA-256:2ACB6E91B694F4F14157B024D3990404453DF52D4E205C99DA14BAEEBE50E429
                                                                                                                                                              SHA-512:F4B58903E25D990464A76F9B4CEDC3FC61FC0C4577E2E7CE586CA7BAC15DA606C214EF944642F4F83648F47B8A9CA978A539DFCA70B35B3E73A54B346471266F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:PK.........t.Jyh.....#.......bcsp_loading.gifSDm........S.!.cd`i.a``0`... fd.3YE.D}.=[s...k..}.[..........$+...Q..9..X-..}u....../.j$ j. j.....- ..g......UT...i.yY...[...[E.y8...?3.Y1.k7..R.-43.P.$....:.%..0.m*...[T..VN3.N.e*....IZLGQ.N...z..y_.?..........9*..e........,/ r..i.YX@>../.....Y.Bd..2.l..L...Y32{..~.uzzi.)"-F&.....t.2..09.<6.c...;...".;...Z...>.0.<.Y... ..<...-.7.;.....o_..0...".|d ........t-...?*.z..z..>........=.:D...A:...%..t....v.."" ]..:..;0........r8..\uC....H.o.K.H...Z..oD.P..:..*.9.i.B.QHC....9.....fw...9.F.QHm*r"v.6GV.....c...F...H.......Hy..:.9f..A./....H.-R.....Y.....FM..G...r...8.. |./.(.?U..=.O...C...|{.......^....#..H.... 90.MYN...GrPH.)..<.....65|9)x.w...d....pd..X....F..dj..L..T...x.Y*<.c.......d.^...q./........g..H,X....cd...i.y<...C.].w..v...]..3A.1....p.`,..Px,.5..4...C......;.w?.`G..Ll..C....z8Z.l4.g...d,.aO#a...9."..(......'.7.p..v........ +.c....<.0h......`....&.....y0m.....t0.....O...Q........Ym..

                                                                                                                                                              C:\Users\user\AppData\Roaming\BitComet\fav\passport_info_zh_cn.zip

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):35631
                                                                                                                                                              Entropy (8bit):7.892420187794153
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:BEMbqKGjLFjbvZkHUfE0D+Db6/ph8U9A6pSmjgk9EMbqKGjLr:Bl/GjtTSUsnDbULA6p/pl/GjH
                                                                                                                                                              MD5:84F24CB8AC63F1EC18B2C51919323F7B
                                                                                                                                                              SHA1:072B317DA3526C130215F1A5F79CD1E0A2D719A9
                                                                                                                                                              SHA-256:3D791EF418D0376204AB1C122A04FD968785B042DDEBD8CA84A06A6187572F7B
                                                                                                                                                              SHA-512:C6771B7593B6B1C912D657CBDF3EB268ABB74D3590FB67AC2BE0A5A7F7A1FB2C4E55E23741653CFD02869AFD47A17AACB745BA8F66EB8D455C1692F50421EB2C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:PK.........t.Jyh.....#.......bcsp_loading.gifSDm........S.!.cd`i.a``0`... fd.3YE.D}.=[s...k..}.[..........$+...Q..9..X-..}u....../.j$ j. j.....- ..g......UT...i.yY}..[}..[E.y8...?3.Y1.k7..R.-43.P.$....:.%..0.m*...[T..VN3.N.e*....IZLGQ.N...z..y_.?..........9*..e........,/ r..i.YX@>../.....Y.Bd..2.l..L...Y32{..~.uzzi.)"-F&.....t.2..09.<6.c...;...".;...Z...>.0.<.Y... ..<...-.7.;.....o_..0...".|d ........t-...?*.z..z..>........=.:D...A:...%..t....v.."" ]..:..;0........r8..\uC....H.o.K.H...Z..oD.P..:..*.9.i.B.QHC....9.....fw...9.F.QHm*r"v.6GV.....c...F...H.......Hy..:.9f..A./....H.-R.....Y.....FM..G...r...8.. |./.(.?U..=.O...C...|{.......^....#..H.... 90.MYN...GrPH.)..<.....65|9)x.w...d....pd..X....F..dj..L..T...x.Y*<.c.......d.^...q./........g..H,X....cd...i.y<...C.].w..v...]..3A.1....p.`,..Px,.5..4...C......;.w?.`G..Ll..C....z8Z.l4.g...d,.aO#a...9."..(......'.7.p..v........ +.c....<.0h......`....&.....y0m.....t0.....O...Q........Ym..

                                                                                                                                                              C:\Users\user\AppData\Roaming\BitComet\fav\passport_info_zh_tw.zip

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):35889
                                                                                                                                                              Entropy (8bit):7.894452005921424
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:768:xEMbqKGjLYob7OHUfE0OojToj9xWmUEMbqKGjLy:xl/GjtqUs3GTojXAl/Gje
                                                                                                                                                              MD5:C2425A4A19235FDC4F91B25269CB968A
                                                                                                                                                              SHA1:5F0FE8A3646E12ECF55A16DBFC7DEC6A46FFB731
                                                                                                                                                              SHA-256:3F3E42D7E5A34279A9577CA95F90B333135203D7FD59646014AC9499D6776805
                                                                                                                                                              SHA-512:A9D26AEDE850A4CFF4DEBF2E94D4942E0A65CAFF69A681118A70AC592C89B4E54E6B25D96F795E02C2A17F21A15BDA7F75A0FF3A938E38D8A4527C5F9203E8C4
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:PK.........t.Jyh.....#.......bcsp_loading.gifSDm........S.!.cd`i.a``0`... fd.3YE.D}.=[s...k..}.[..........$+...Q..9..X-..}u....../.j$ j. j.....- ..g......UT...i.yY...[...[E.y8...?3.Y1.k7..R.-43.P.$....:.%..0.m*...[T..VN3.N.e*....IZLGQ.N...z..y_.?..........9*..e........,/ r..i.YX@>../.....Y.Bd..2.l..L...Y32{..~.uzzi.)"-F&.....t.2..09.<6.c...;...".;...Z...>.0.<.Y... ..<...-.7.;.....o_..0...".|d ........t-...?*.z..z..>........=.:D...A:...%..t....v.."" ]..:..;0........r8..\uC....H.o.K.H...Z..oD.P..:..*.9.i.B.QHC....9.....fw...9.F.QHm*r"v.6GV.....c...F...H.......Hy..:.9f..A./....H.-R.....Y.....FM..G...r...8.. |./.(.?U..=.O...C...|{.......^....#..H.... 90.MYN...GrPH.)..<.....65|9)x.w...d....pd..X....F..dj..L..T...x.Y*<.c.......d.^...q./........g..H,X....cd...i.y<...C.].w..v...]..3A.1....p.`,..Px,.5..4...C......;.w?.`G..Ll..C....z8Z.l4.g...d,.aO#a...9."..(......'.7.p..v........ +.c....<.0h......`....&.....y0m.....t0.....O...Q........Ym..

                                                                                                                                                              C:\Users\user\AppData\Roaming\BitComet\fav\skin_fluent.zip

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):454899
                                                                                                                                                              Entropy (8bit):7.957987446000835
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:cJ5q0bbKTNOCOeow0ukq3RActFe+HaqYTHs9:c35KTkteyFie+H8g9
                                                                                                                                                              MD5:C117A545DE89C679D841674614A3F9F2
                                                                                                                                                              SHA1:C5C3E49F0B923AE91BD84E531045B1809434866D
                                                                                                                                                              SHA-256:C0846BCC3FF7BBC84C09144B1DFAA2E22AE944F0F0FEBCB801B0125CE66158B4
                                                                                                                                                              SHA-512:A07DBEB9593C56D1EF6CFC1FCAC85A28E2D552E4FCB50BC0E9AB96208CB98428387A87DDCC29459624272D7A1D242E5AF285AC15709DB127C31AA539E3C74429
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:PK..........V..F.............app_icon.png}R.8.{._QB...2g..\6..M....$T.266l.l...N".PDQ..(.\*.BQ...I%.~.%.g..y..t......}.....}.....6..P...@R..8[..Yy..~Y....E.m....<..D&.dB....K..lK&..|..w.@"...l..~.;@.%.`t94.h%v..0...d6..I..A.**..*..z.E...X2.j..$..Z..z..I.=....P.Ff.!.......A.....+e......m.........d.Z......Av.u...8..A"{hC.p.>...>:z.....@B..Tx"....'...6.......u..u..'L..F.h .:B..+..&rt.,...82.Ie.........?.......t..V......0=]8._@....4.O4.mK...4.>.A..Y...,......,.Ld.L{....I....X...A uQ..G.t......V\a,.,6..N...A..]*........v..MPzzff.h,....3A`....]?.8..F...pI.pw......l2.z.L.3.....P....K..\...........WJ..ge.sv....'.#......# ...%..#H9r,...........0......4...w.}2..~..Q.}.{..J.\I5nNt..Y%9..i.V..&..ur&.{..f...Y.....]h.......9.8.P.<..-.4.Q......o$.}..!...S.as...a....;"..s......Y3...q...7GB.$.C7..`..'.+......k..=|..........K...}t.EF.H.....Tf~.WL...t..2a.#..t..x|...c....;G..:....oD7.z..qS....>.Kg...B.#.n......u*..xo.....j5.t.]..W...cel.U...<..o..

                                                                                                                                                              C:\Users\user\AppData\Roaming\BitComet\rules\cometid.db

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\BitComet\BitComet.exe
                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3007006, page size 1024, file counter 2, database pages 4, cookie 0x2, schema 1, UTF-8, version-valid-for 2
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4096
                                                                                                                                                              Entropy (8bit):0.9790173265894578
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:lpbNFlo0aK2auB5f8Q4g91435gQKhCmLFKhTSSgLu9EgpruWFxQWFtuWdzolJ2G:HLG0BruB5jGpgQKNwZfF2oBjzolh
                                                                                                                                                              MD5:EC5AEF4B94DC9C888D8201A5A3E25D26
                                                                                                                                                              SHA1:F73F776B9080F56C48BE35828402A5B665E745A8
                                                                                                                                                              SHA-256:5B5BA61C1521D7AA7971832FA0820DAB8D989E78CC878D8553C3403371F3B085
                                                                                                                                                              SHA-512:1EF9A12CEA589514AD96735C9B11327F2141DD8925EC2086EEBE96C54801D3ED46BA28C200B39E6870FEFB0988054EB37B91A0F97781437FA25349172A0C0183
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:SQLite format 3......@ .........................................................................-......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................l...+'...indexidx_date_useridscore_history.CREATE UNIQUE INDEX idx_date_userid on score_history (date,user_id).8...''../tablescore_historyscore_history.CREATE TABLE score_history (date char(10) not null,user_id int not null,score_min int not null,score_max int not null,primary key(date, user_id))9...M'..indexsqlite_autoindex_score_his

                                                                                                                                                              C:\Users\user\AppData\Roaming\BitComet\rules\cometid.db-journal

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\BitComet\BitComet.exe
                                                                                                                                                              File Type:SQLite Rollback Journal
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1544
                                                                                                                                                              Entropy (8bit):1.7697710133574984
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6:7+/lmtgrgpbNFlEuX10Z8IFKhTSSgLu9EgpruWFxQWFtuWdzolJ2Go:7+ti8+LiuF0uIwZfF2oBjzolho
                                                                                                                                                              MD5:B6B18B366DAC9ABBED0CAE9B84A50602
                                                                                                                                                              SHA1:66E039B5139AE180E0A594543AF45F967C827805
                                                                                                                                                              SHA-256:DED70262171BFC251A03620D0B8EF59AF74726616BA0C15FA8E1B4CF04EB1905
                                                                                                                                                              SHA-512:51669AC221DB393B81ED1FC8EFDD8761DA094648845E449FAB00A01D155A429C6A22C834360608EE740164832DD6E0DE3CBDACA3C28D81E1BCFAF98778F40B3B
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.... .c........f....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ .........................................................................-..................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Users\user\AppData\Roaming\BitComet\rules\ssl_cert.dat

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\BitComet\BitComet.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2831
                                                                                                                                                              Entropy (8bit):7.939002113836396
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:cHyhI6wH2uXBtaUFt6P36CNHPmyRaK43/OcTD0ki1VzyFXdEpqVxNq179F3FNDLU:cEIFzBAUGqCNHh6TFiKXi0bmJ1DLkj
                                                                                                                                                              MD5:2BDDA28FA6D956144103D9BEAF20BDDA
                                                                                                                                                              SHA1:B3AAE8ED12D6E544D5B15A6A52865EFE778CB557
                                                                                                                                                              SHA-256:A4E1A76688206B32FD9C3C6DC89464FE36706FE01713D0049600DB5A934E3226
                                                                                                                                                              SHA-512:0336A2EDFD867B68E5DA0AD553CF08002727DE6EDA824097E93219CCCC3974678FDBA19B4BD04592188584C68AD8DC40388E22598B0FD21B5C344F95CE3CD42F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:U..E.....D.....j.q#.....0U..,.k.Yu.b.s...5...d..K...Ep.....0...c..G..z}Y.m... .!2/..}...[...g.Ri..KD.....e.~..6.w,@..j.B8j.g-...R..6!.$....(.V...|u..e..]"..%_..l.5..9*..2'.jr......y -.D...Yj.E.l..L_.P...X.:..(...6.s.R+q....:)`......+./.U.8...YPrhE..It.....P........ZcW....a]...2.LM.ji...+..?....N9..~.q:0....Bo..#. ..;..%S...a.!.*..MT....o.6...j>.. T......{S.%.Wu........E\l.DZo/..,.+.H.;.`5...9.^k.>.?P....G~......l..Bt!........H0.........%..E..k...1....V...z....`.b.Fx.....w.H..B)g7..l....;..p.%y.Q.U..Xu..........n..A?][....d.`.N..........PK..K.@\.....&u...m..H.@.`.....^...i...1..L.`...v.x.|.2.%..c...&R7.8.....,<5.]..M...8.u......}...v.3...5....@h...[.Z..D...;.z..K.Z-......N.u&-.C....&9...p.[.C.k......O.........?(.{..}z...J...e....'....^.S..Y...9.}A......s.y2.).}..".j6..DHa.(......"l.d.~....a&n..>XQ..n.&.E.?.U..Co.Fx.2.O...qX.p]... .w<.......>~.. {..CSh=...T.{`{.k.*x7m.@./(.P.6P.....,w.o...n..qA'.7..<....q..'..o.#....r...m..T.q.qY....

                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\44404f5c61c7d7c5.customDestinations-ms (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\BitComet\BitComet.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):5120
                                                                                                                                                              Entropy (8bit):3.1510801589975186
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:WxrVudlJC10bdd63A66rrxr6udlJC1edd63A60rxrr7udlJC1ldd63A6yHBW1:W9wJ999rfHy
                                                                                                                                                              MD5:CB8BE64BCB5F81E168652582566283C2
                                                                                                                                                              SHA1:0F90FF3CFC133E06B57424B02B20F7EA31600563
                                                                                                                                                              SHA-256:84C643CB509E711BE7FBA990FAF74569C5C0546DBE3D4152876257D2216E02F7
                                                                                                                                                              SHA-512:880120E766418F9AEB09BE247681FF4F86AE74CC64856AC46E42DF457AB43390A78B287B320E8512BA2C043C66FE9375D84BD52B36C259D99D2C4A81BC58B5F3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:...................................FL..................F.@.. ....>;.V.....-J....>;.V..........................{....P.O. .:i.....+00.../C:\.....................1......X...PROGRA~1..t......O.I.X.....B...............J.....l...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....Z.1......X...BitComet..B.......X..X.....y.........................B.i.t.C.o.m.e.t.....f.2.....X.@ .BitComet.exe..J.......X.@.X.....|.........................B.i.t.C.o.m.e.t...e.x.e.......U...............-.......T...........4..!.....C:\Program Files\BitComet\BitComet.exe..../.s.u.s.p.e.n.d.&.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.B.i.t.C.o.m.e.t.\.B.i.t.C.o.m.e.t...e.x.e.........%ProgramFiles%\BitComet\BitComet.exe................................................................................................................................................................................................................................%.P.r.o.g.r.a.m.F.i.l.e.s.%.\.B.i.t.C.o.m.e.t.\.B.i.t.C.o.

                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\IC9BGELR91COB42GOU8X.temp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Program Files\BitComet\BitComet.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):5120
                                                                                                                                                              Entropy (8bit):3.1510801589975186
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:WxrVudlJC10bdd63A66rrxr6udlJC1edd63A60rxrr7udlJC1ldd63A6yHBW1:W9wJ999rfHy
                                                                                                                                                              MD5:CB8BE64BCB5F81E168652582566283C2
                                                                                                                                                              SHA1:0F90FF3CFC133E06B57424B02B20F7EA31600563
                                                                                                                                                              SHA-256:84C643CB509E711BE7FBA990FAF74569C5C0546DBE3D4152876257D2216E02F7
                                                                                                                                                              SHA-512:880120E766418F9AEB09BE247681FF4F86AE74CC64856AC46E42DF457AB43390A78B287B320E8512BA2C043C66FE9375D84BD52B36C259D99D2C4A81BC58B5F3
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:...................................FL..................F.@.. ....>;.V.....-J....>;.V..........................{....P.O. .:i.....+00.../C:\.....................1......X...PROGRA~1..t......O.I.X.....B...............J.....l...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....Z.1......X...BitComet..B.......X..X.....y.........................B.i.t.C.o.m.e.t.....f.2.....X.@ .BitComet.exe..J.......X.@.X.....|.........................B.i.t.C.o.m.e.t...e.x.e.......U...............-.......T...........4..!.....C:\Program Files\BitComet\BitComet.exe..../.s.u.s.p.e.n.d.&.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.B.i.t.C.o.m.e.t.\.B.i.t.C.o.m.e.t...e.x.e.........%ProgramFiles%\BitComet\BitComet.exe................................................................................................................................................................................................................................%.P.r.o.g.r.a.m.F.i.l.e.s.%.\.B.i.t.C.o.m.e.t.\.B.i.t.C.o.

                                                                                                                                                              C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                                                                                              File Type:JSON data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):55
                                                                                                                                                              Entropy (8bit):4.306461250274409
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
                                                                                                                                                              MD5:DCA83F08D448911A14C22EBCACC5AD57
                                                                                                                                                              SHA1:91270525521B7FE0D986DB19747F47D34B6318AD
                                                                                                                                                              SHA-256:2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
                                                                                                                                                              SHA-512:96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av-vps\bug_report.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe
                                                                                                                                                              File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4903360
                                                                                                                                                              Entropy (8bit):6.523021555106586
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:49152:5MLOHWldqrWoquLx/T89r7z2kv6s0sYBnYLxluk4xINfsAtcq/d9Y+JR8UyQ9UsM:4a/+zAlYOkqCPmZQzHUI6HNyG
                                                                                                                                                              MD5:4680308865706874CD08754B88AC9DE0
                                                                                                                                                              SHA1:F1F99BABCC056131351A3D83BC249B95EAC6FC86
                                                                                                                                                              SHA-256:96349305E36EBBCD303D8343A181DB840CF9D38DF683DE63437B3C427B20CB84
                                                                                                                                                              SHA-512:ACE40FBD7C9247958321A39FA29CA1DDA0492E9034A8B62A35088AFE0BD2875B168383FF1378F7EDBB4424BF0901E3DD00F2FB76C27F2940BFC8055791A0DAE3
                                                                                                                                                              Malicious:true
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$........H..T)..T)..T)..[..)..R.$.X)..R...G)..]..])..R...#)..R...F)..[..D)..]QJ.V)...\..N)..\...)..\..U)..T)..Y)...\..|)..[..p)..[..s)..T)..6+..>...6(..>...U)..>.&.U)..T)N.V)..>...U)..RichT)..........PE..d.....~f.........."....&..2..4.................@..............................K.....JFK...`...........................................@.......@.,.....K.......H.HO..H.J.x)... K..f....:.......................:.(...p.:.@............02..............................text...,.2.......2................. ..`.rdata..v....02......"2.............@..@.data....|...0A.......A.............@....pdata..HO....H..P....G.............@..@_RDATA........K......6J.............@..@.rsrc.........K......8J.............@..@.reloc...f... K..h...@J.............@..B................................................................................................................................

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av-vps\bug_report.exe.lzma

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe
                                                                                                                                                              File Type:LZMA compressed data, non-streamed, size 4903360
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1453456
                                                                                                                                                              Entropy (8bit):7.999857062931511
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:24576:JTyrUHbGVaB/cW1j/Vlir5mrHIyRZv89qwA95oNzGqieN5UfZVZnihrHiCUFFTnN:JPyVaB/cqXgE0aR89u2NyqhHUBV4hWCm
                                                                                                                                                              MD5:7FB28BE6BDF0DDED004D045BE1CFD06E
                                                                                                                                                              SHA1:E2D4C8BE567798F8A373600D2B4D3ED1A9D8225F
                                                                                                                                                              SHA-256:ED83DAE48F39837F8EB2B586466A895407F74D2CFB78C365EAA943ABC3A8CE7C
                                                                                                                                                              SHA-512:D8810A96FB380DA7E6D874C790F9E6EAA774671EA5859FC7048CDE7AF373BFB8296566F1AE6F7A62DAEF1B6C3BC7B283A6CA8AB3D1CDF3EE735DA042FC8AB000
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:]..@...J......&..p.........../D.|..y..:.}.._..G...5mA..aQ..c5t ..+........w.uRl.,E.u9....r....dV...l.....>h.Et....T...9..D......m.V.k_.J........m........#\,,.sI.w...h}.......aJ..VFAS;.R.g.k...&*...SU.....:..9.We~Q....{..e1..5*.T[/JM<.h.....#.t...\Q,...R..\*|.Q+s..A.2....b]o,.r..@z.f._..X.t'.c..../..5>w3F...u.8+.g.&1..[..t.V..).+.?6.....Y.....lb....W....2.;F.8.0( ...%.M}..8....,D...=...u.r.A...)C/...Z.!.=d.'.xos.."..>.. ...=4k......J8X^.G-..D.p...u.j.@...^F.D...Z..?.o..PT...WF...C.,..a0P.[2..V....n...Y.*...\....t.k].....?e|....#........&:....O.....3?'/........@...{A.......6.Y.+}....W0k..^.B0u&...o.....\q,.;... ....$.....A... Z..."...].Gj.f+g...EN..7...%.Q..m..-..'.....{.=......\d.]5H*..n.,.Q...7....!..,D^_...z.....mx.4..h...&.H......{...1na.fk.=.S.Da..S..a...1.).kr.!.........a..3#....@y.,z......'Wwrp..+M.....;.~...TC..x.A.....N..-d.Js.)...&.3@;m.l\LAVr+_.........<..f1g?.p.B.y.d.&....f.......P..gD.....}q..`hbz...{..]./.~O0y..M....+......lP.

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av-vps\config.def

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):583
                                                                                                                                                              Entropy (8bit):5.420768601460394
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:2AcW1OPqygANI+xzYN/qb0a3Uk7oMQuROfzUoygMaSailnk44Sk:rVAJI+dsqNUk8MQuAL6zaiO44Sk
                                                                                                                                                              MD5:9500A348FDF770035BFFC688F02560E9
                                                                                                                                                              SHA1:C22BB1FCF44F699EA1F120CCBEEFA09743DD5E11
                                                                                                                                                              SHA-256:C9B86EB997D856FCD3004663BAB5AD582591A52FD254368A385FE1BFE14FE97E
                                                                                                                                                              SHA-512:D69501B3717D99276DDB82182C0F9A79D87F814CAD4505AE48089E0C9B55757C99BA604249B16899D70614E96A474657C2B0722B4F87E1BC329F2B7E53CBD33C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:[ui.offer.actions]..url=https://ipm.avcdn.net/..[ui.offer.welcome]..loadtimer=10000..url=https://ipm.avcdn.net/..[reporting]..disable_checkforupdates=1..report_action_ids=RID_001,RID_002..[common]..config-def-url=https://shepherd.avcdn.net/..report-url=https://analytics.avcdn.net/v4/receive/json/25..[ui]..enable_survey=1..[updating]..conceal_hours=1..fraction=100.0..updatable=1..[CrashGuard]..FullDumpFraction=0..[Signature]..Signature=ASWSig2A5D9021F918012489D99575F1C3B36D0B3329558BD896120BDCEFB905A42B4C2051FB13DB532924923D89C521C99F120847664434E723C31CDD03D5D2FF0B57A7ASWSig2A

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av-vps\dump_process.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe
                                                                                                                                                              File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):3492792
                                                                                                                                                              Entropy (8bit):6.523611689928403
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:49152:9L/2e3LWxgSvcP11BLUMScTGMwe6PdBZXbIKTpHxHcQ66WJ0V8lArtYtPtRaJg1C:972CdLDwXTZoQFWSY5Xo
                                                                                                                                                              MD5:85B73D6122E0CF01EF2780F8BE549697
                                                                                                                                                              SHA1:4BBB507638AC96EBCBB9330EE991C9DC11A4B1A1
                                                                                                                                                              SHA-256:96DEB928F562918A57E6656702F117E12FAA9F8E8FB224E247A5415C96489265
                                                                                                                                                              SHA-512:14786E79019D363074C3F8E2CD38E068E1248EA6E2B2101278FA3B3C85989B0EA01C6F2C2F3F4F221F70FB7A3E267C8CA647D1459C9AB1E86A00DBBB67B28216
                                                                                                                                                              Malicious:true
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.......5...q..q..q.....z...........m..wy'.r..wy.c.....x..wy.e..wy....x.I.s.....p..q..v..'..r.....h..q......y.....y.p...y%.p..q.M.s...y.p..Richq..................PE..d...O.~f.........."....&." ..........8.........@..............................6.....|.5...`...........................................+.......+......@4..Y....2.....H"5.p)....5..U....&.......................&.(.....".@............@ .@.....+.@....................text...L! ......" ................. ..`.rdata.......@ ......& .............@..@.data... .....+..$....+.............@....pdata........2.......1.............@..@.didat..P.... 4......n3.............@..._RDATA.......04......p3.............@..@.rsrc....Y...@4..Z...r3.............@..@.reloc...U....5..V....4.............@..B................................................................................................

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av-vps\dump_process.exe.lzma

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe
                                                                                                                                                              File Type:LZMA compressed data, non-streamed, size 3492792
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1016062
                                                                                                                                                              Entropy (8bit):7.999798504944077
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:24576:pitHj/5KLdJCC6HvF4nKvK4J6+NYqwtkxAAmAi:p0cKSnABXZwOxdi
                                                                                                                                                              MD5:5D8A49107276251140F75A28B443EB65
                                                                                                                                                              SHA1:995F7B3CF1D885F5FC793FA004ED3E297EAA28DB
                                                                                                                                                              SHA-256:D9E9A848E4F5FF8F4DD56227F72A3978F2C3FC945645A59AB3449CF656C3A081
                                                                                                                                                              SHA-512:BDFB0C8818C2DFF066801D7FE3C789D5684D5E6F1C8657BC4664AC2DB216E35FBDA85A5CFBDE0B4A3CED9E2CA9488DCAE8C704090FFB7D35C2E0CDF7FAFD98EA
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:]..@..K5......&..p.........../D.|..b..6>..p.}#......G...)p{` ..i=`...k.<....G..7.p..C..K.N.......A..$.....G.....hK2...{...C..{!(.V.x...^.]1.|g.@.:,......@...../....}...#.>...........B.}m..+.r[L..\.....-..d...uX.x@..k".o....D.j.6.C.,.....m)_d>b_...^..ZiI....~lX......|o...7.5v...3.........-.g.S........W..4E..+w@.r....a..O[..gq..~....c.L.....h'......z.}.....WK"..T26..}..+..!.BZ..._......^.#..`9.S.....Dm..m....yO.{.w!j....EQ^......u..m).....j....1...x.=C..#.k.........h.z.8....Cz*...U....L...?7m..9.6..Jq........e.&8.].;ZK.U|:...VEnb.9......g.21...He+|.}......G.I.....s-Zh.j..>.!....h..D...Lr.7..jX......V..''..(.r.$.^.Ev....."=>...J..y.7Z.. ?...P.^v(..+(.....;...`,...........j.F..,[..F^.E..=...h..9....Ka.f3l.f....`.*|..b..........(../w..a...X...GX.}$P.1.3IE..K?.lyO....5G..Uc.W;.&......P........w2...6....LDxDF..Fy...?&.>|q.u[2&..BQ8...S.....&....eo...9.J.ek5.{..J...VK.......f.6@...H..[~c...Zg.C.h..z?..2jL...".5..2k...:..t.I...O..T.S........

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av-vps\icarus.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe
                                                                                                                                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8027584
                                                                                                                                                              Entropy (8bit):6.454807265164592
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:98304:U57jebwSZyb1+CzfX+9KgiVD7fnmoq+AKQg2sJOrrcG5:U57jebwSZyBhMiRfmoq+AKQg2sJyI2
                                                                                                                                                              MD5:D4A25F1FB035722FF5BD2B14225397E6
                                                                                                                                                              SHA1:DBEE26FB1E0BBC7532572B0D36A851FB13B9D726
                                                                                                                                                              SHA-256:26D05EE137D76B2266D2B907B584B908661F07FAD791EBB1A355C5378D9AF775
                                                                                                                                                              SHA-512:E870D9A6F60A05C2789B8996B031629951EEFCA4BD262285CF94233E9E8A4246DF286E99F57F2E9D2849123C9D12436B71E4E967B700E68C30CC18BDFE44025D
                                                                                                                                                              Malicious:true
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$.......................+../....(c......(.....(.....(.....+....+.....b......b................2..f...:....................+......+.........|...(......(......(a.............(......Rich............PE..d.....~f.........."....&..T...%.....P..........@.............................p{.......z...`..........................................\l......]l.......y......Pv.,U..HTz.x)....z.......a.......................a.(..../Y.@.............U.x...@Yl......................text.....T.......T................. ..`.rdata..$.....U.......T.............@..@.data...`.....l.......l.............@....pdata..,U...Pv..V...nu.............@..@.didat..p.....y.......x.............@..._RDATA........y.......x.............@..@.rsrc.........y.......x.............@..@.reloc........z.......y.............@..B........................................................................

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av-vps\icarus.exe.lzma

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe
                                                                                                                                                              File Type:LZMA compressed data, non-streamed, size 8027584
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2417834
                                                                                                                                                              Entropy (8bit):7.9999214609490314
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:49152:/4cLFyTM/tDMyO4G6rRQOP4+jBB+mDSRf941zXsC8vb0KYrpSP:/UTctDMyXVlPpDS74ZJ8vbatS
                                                                                                                                                              MD5:46B9F2451E6B7C62AA70E414AB16BA0B
                                                                                                                                                              SHA1:EBEA19F3A5FC167ECC8340EFBBB3A16DAC791D79
                                                                                                                                                              SHA-256:899C5EC211B3678C87629A8D53B64058C44713E27C89CDCC2BF88150FB077B5F
                                                                                                                                                              SHA-512:16604E4C9741833D1B944A155B74CF277CDD8A49FDD6FED2A775A1340F7A0D758E37FC2A4266703A30AE8E741B9AD140C77A1CC046F49E8CF3AC580E41AC72B6
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:]..@..}z......&..p.........../D.|....o.e.F<w.,...vY.Ta.....NE..1E...V..Z..m9..^../:Y!....y....eg..;..XR{.Y.d.r.F.[>W.K......T P..~..A.P...9o..g.u.{H.,.....7.a..4..X..s.t.3..~a.jX..E...Q....L&z..@..V<D.i..&...(7.......@JOc.\.O...p.\<.C...=....<z- .....x .....sY.6.~..iS".h.... .....p...~.@[.....~/p.E.J...6.5.^....<..=...!O*.e;/.....N].r.B..M.u.2.{.M.P.j.Y>....R.:...J50FH._..8A.i........!.!.P..?K.~!...R....%K..e...E?|.".+][...[..h....'c<..J.V........./.92..I.:q..lE|.\....S..xC.w...r......T.S'"'.I.....?LM_.(.>h"...{.K.....@.6......#.w..8ab...v....SO.2.....Y.KP..'..?X.X..........|pb.>..d$...G.k......3.U..lg.|....b.&wS.....{(..2..9..I.fl.d.A.kT.PU..nF..+.dY.tc.....9..h....3GW...).i...q..>+&.RG,-.\>-.|.k....!J...u."G.....c.a.......++..V..Z.}.]~.6.....3...&8........(......XQ...x2.L....L..3....I....V+.g..>.g,..T.2...`Y.-..yZj...W...9..X...M.....9.m?.E_...5[.C...+D.....;..a....i...}5.S.)'.........6..I..R... 3..q..~...$.......F.">/q-.X.uJx...

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av-vps\icarus_product.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe
                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):876992
                                                                                                                                                              Entropy (8bit):6.586309859473597
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12288:LuFe7FiKEsFEiqh809pt/yBsrTiHD+fKCDhtjpph0lhSMXliN1oNKZh:LupdsfqhO2lh9bh0lhSMXlKYS
                                                                                                                                                              MD5:12944FF977E49D3494863739A126AD27
                                                                                                                                                              SHA1:46372EE27FB8C9DDD6F239AAB16A014F45BF4CD9
                                                                                                                                                              SHA-256:4CEB166B78A9B1C31EFF514995226747A4016FE68F0567896F5C0EC4D5904DE1
                                                                                                                                                              SHA-512:F8E5BA114DA526BA9BA36EBEED6A8684520623AEE043DAE9A574F37D303CB7418758B26E524F2818342573DE23FFC6FB3EC4B18E0B9E7A5E9DA4C3A237F5D276
                                                                                                                                                              Malicious:true
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$.......*.n&n..un..un..u...t`..u...t...uh..ue..uh..t...uh..t...uh..tz..u...tL..u...tl..u...tf..ug..um..u8..tt..u...t...u...tm..un..uc..u8..tj..u...to..u...tF..un..u ..u...t...u...to..u...uo..un..uo..u...to..uRichn..u................PE..d...b.~f.........." ...&............ ...............................................Y.....`A........................................pq.......q............... ..Pj..H8..x).......... ...........................(....~..@............................................text............................... ..`.rdata..............................@..@.data............H...l..............@....pdata..Pj... ...l..................@..@_RDATA............... ..............@..@.rsrc................"..............@..@.reloc...............(..............@..B........................................................................................................

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av-vps\icarus_product.dll.lzma

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe
                                                                                                                                                              File Type:LZMA compressed data, non-streamed, size 876992
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):325210
                                                                                                                                                              Entropy (8bit):7.999397389089007
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:6144:QhhJemEAfybyvAHZ92RT7L4O/x5bKW9zWhsX0BBVR5Y5jypYAerSJiGq:QhhJlEAfRvAHZART/jzbKk5EBvYop7FS
                                                                                                                                                              MD5:895EBBE9504B6DD26EDC360C15B072C8
                                                                                                                                                              SHA1:F2084C9C295134DB867DC8CFB5A4A5C687A3EA9C
                                                                                                                                                              SHA-256:F23E5040D486A45D86C8A47A81E771AC46305D077719F79DF8DDB2CF5189A9FC
                                                                                                                                                              SHA-512:1ADAF0DCF2ABA37A26757716A83EF3A7EDEE5B3175AB219682E20787E2336BF7F6576EEF10CE042ADD2FD58A897A7FA827390BBA8FE4AFCDFBB3C4DCD93698EC
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:]..@..a.......&..p.........../D.|......I0..y.]n.u......i...7.....B]......F2$1..../e.Y.....f}..tN.b....:..6..<}X.~6z:...$j*b..0}.....B...y.%l...%..Ch.........|.r ..f....p.5..3.....]XX.#G;.\.m1..0.r_.....c...x..j.2.g..8<......._..^...p......)b....j.z..DX.z..3Z.5.].)3[...<.e.d. .......\..(...}..|..)..6...}.m.!.z..C.+1.i9Z.&.y.G-.hV......... .....V.}..U....;.....1...)..0J.eY..Xd>@..3F.8.....cN....y..Q...,.R.................X.|....Ef,o..C!0O.>/.....Ili.&Gt.....f{To.. .U..n%Bh.b.....o45.`.{{..S.....sV..f....T|..P...R.``P..mq......Ps..AH......J...sO..\~J4.:._..........k.......r.........?_.)[.m9.c/.}.....9.......E"....P3..d.IV.Y.M...%.w.7q.... ...;.xaO..*.D....h.,...)...\..`..7..E.l.q\...4..'..)...v..~v......w..V-.P9t.s..03Y)xY...F/.* . r8...l23.(..S.0.vp..<5.#z.......T,....;.oa^..n$Z......d.g...'...!.G..>r#..S[.G..$....081.......<.#7.g..>...#...r......h.7..K^T..E..=.<.}.[S=......h.'.........O..!.7j.....Q..B3..Rkz.A6...!........1.9.

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av-vps\icarus_rvrt.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe
                                                                                                                                                              File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):50976
                                                                                                                                                              Entropy (8bit):6.695978421209108
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:6fMVFuX7Y1C7X+oAiZ8uMX07F9Kx24Zza:WMVFsSC7+K8ua0qm
                                                                                                                                                              MD5:97F5D0CAAA1988C95BF38385D2CF260E
                                                                                                                                                              SHA1:255099F6E976837A0C3EB43A57599789A6330E85
                                                                                                                                                              SHA-256:73EE549578DED906711189EDCEF0EEDBC9DB7CCBD30CF7776BD1F7DD9E034339
                                                                                                                                                              SHA-512:AD099C25868C12246ED3D4EE54CEF4DF49D5276A5696CA72EFA64869367E262A57C8FF1FB947AD2F70CAEF1D618849DBAB2EC6161C25758D9F96733A7534B18F
                                                                                                                                                              Malicious:true
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................r.............../......./b............../......Rich............................PE..d....>_e.........."....%.N...(...... ..........@..........................................`.................................................\u..(.......8.......P....x.. O...........l...............................................`.. ............................text...)L.......N.................. ..`.rdata.......`.......R..............@..@.data...............................@....pdata..P............l..............@..@.rsrc...8............r..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av-vps\icarus_rvrt.exe.lzma

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe
                                                                                                                                                              File Type:LZMA compressed data, non-streamed, size 50976
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):26032
                                                                                                                                                              Entropy (8bit):7.992977293575329
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:dXkqelTjZK0JgHW7tbzdiH2P6AdRo7+lmAg:dEfJJZtwH2PJbuUg
                                                                                                                                                              MD5:F13E71BDBBA9A80351A786C44272F737
                                                                                                                                                              SHA1:DC8F9B86B56684F3A7BD7DBB16DC27B436735E97
                                                                                                                                                              SHA-256:7E7DF8B8EF9226E9E916199D8721E52D8737654D6EC5A8A3B11B49CFA6633D34
                                                                                                                                                              SHA-512:2D8BF0BABE54618CD81212990BA9975CEA64C5E51172DAB95004364229B0A35190F94DF2E37FC70E93DF2A24EBC2339BD0A8801411ABE1F98915E6873562E7FC
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:]..@. ........&..p.........../D.|...G'_..z.-~A..\..*~kHy54......<.....=......6......! o..- 6Y../.e+.Y.1~...~y. .....}..N..H.)G'P0..K..*..?.."...c.|..p.z.m!*..D...P.X..@~..E.B.T....5.7o..Y[C.......1.f..]?.........*......W....z.V.b}.H....h0......>./...w.K..}.o..Tm....V|.2.,f.U.......C@.]..e_.&....3....5NC.:.Tm..A3...:.q'Pj2}.m...1k.s.T....O. .....sq.&PaB...=.F.f.F]..;..'...W....{i8......Ki.u.i..2#..*....L.........F......~..x.W..@.J..X..*.'....0t.g.B....b....Z...@~<...8QZLR..2>_.X....=q...%..r*....oP......B.*&..wjV.........`..-..K.=.&r....*....Mi...q..{!..P.aF........-)D.9...r.iE..3..Q.....}.'....o.VL.3.].fW...,......R....<.P.l./.>.%3...{K>...=0..m.B.....f.=...E.^3...."n{.kw..-./-.,..D.d0..$*...rq$...=...g...._n~...H.....p.I..e..U..(._.5.W..y.7.r.^......?|h..\;$.IW....E..N..$.....>..:..."....v.`Jya.MF.\.>.N...\.....I.m.*e.+.Ut....._...xo.[$.M.Q..V_..X.~.XO..'M;.*.(.@....X.d.{..g...0Lx.C....*......`w.o].....O5.'..Y..........y:}..w.....$.b.{....b..IJ..

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av-vps\product-def.xml

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe
                                                                                                                                                              File Type:XML 1.0 document, ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):59456
                                                                                                                                                              Entropy (8bit):5.135627954525058
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:vOt4htHPgPSOKOYIZcXth2+KBI4TLjJploX7AsIszzyo/LfOM1IqFn+G/WiSkxwk:LnrsIcn2RuXnL38
                                                                                                                                                              MD5:B56916BA5E723A79776529FCC10B18C1
                                                                                                                                                              SHA1:478503499BD69C04B62A0C265AC12EC9E68AD7B2
                                                                                                                                                              SHA-256:026588B232F57854131E39A67E52B9EB1ED53C2D150388C2557D8794E91440A9
                                                                                                                                                              SHA-512:A75AD55BDEF9002E8C9CBDFA68B5C9AA3B6C4336D034600E3A7E8042155D40ED52DD2A3733D57E64A905FC02740ACFBC04EAED570E8643E4EFAE4D712090DED5
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:<?xml version="1.0" ?>.<product name="avg-av-vps">..<product-defs>...<config>....<install-folder name="AvVps"/>....<full-name name="AVG Antivirus Vps"/>...</config>..</product-defs>..<group-defs>...<group name="base" mandatory-selected="true">....<action-list op="install">.....<delete-pending-files/>.....<commit-extracted-files>......<important>true</important>.....</commit-extracted-files>.....<expand-vps-version order-base="commit-extracted-files" order="+1">......<important>true</important>.....</expand-vps-version>.....<copy-path order-base="set-property" order="-2">......<post-condition>.......<directory path="%PRODUCT_INST[avg-av]%" exists="true"/>......</post-condition>......<src>%PRODUCT_INST%\*</src>......<dest>%PRODUCT_INST[avg-av]%\defs\%VPS_VERSION%</dest>......<ignore-same-files>true</ignore-same-files>......<move-type>Immediately</move-type>.....</copy-path>.....<copy-path order-base="set-property" order="-2">......<post-condition>.......<directory path="%PRODUCT_INST[avg

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av-vps\product-def.xml.lzma

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe
                                                                                                                                                              File Type:LZMA compressed data, non-streamed, size 59456
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):13317
                                                                                                                                                              Entropy (8bit):7.987638127439293
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:FCMZ6uglQrfFfDT0rwrPC1O+ao+UvFh6q2SyhR6SW:FCMZ6uglIT0rwrPC1vaovmy7SW
                                                                                                                                                              MD5:8CDB9280276B5ECD996477425E3B43E0
                                                                                                                                                              SHA1:5B8C5E6C00F5C736C61B064690A67C1A3DBAFCBD
                                                                                                                                                              SHA-256:07E1E210701309DB8A747DD3A67FE7E37E5300CCEC03AFCD06942DF9E5AE0285
                                                                                                                                                              SHA-512:3D1B3D1D978536C502AD94EDD0D3CF0ED13FEA95061260CB85926A0D3B123BCCA38336E12CDCCD1424E5D5D03C36A8A7FDE86CB769A910E4C14232803A22226A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:]..@.@..............f......{3....&.7d..>$....`K...H......8..:_..~...\......>./........%..H.......o...Y....9-.f.P!....p...tC.k.....[...j...7^..1......N8...2....`..D.X.....h.TXhJk]......k...*3...J_..@[...URa.nK'.9W.a..Z.3k/.1e..gF6?.t...~.3e.=........BD....v...G7=..C.zM[B9d^..A...!....3BN3.(`..5T.....ZY&#AM.JA.......lnm.L.`x.......b@.`!...:...ZV.M~.P.%,.p.....Y..X2.oa.\.....}^....>.....7.{R=...3m>......I40Bua......[.q..Fn3j1....V6Wr..i9=P.'..a.y...|...\i&..EP..x.[y....Y5z<...dI..e..D..6.G..5*..%i^y\...O..:.....{...]/..%.[.......I+R...<\So...tPXA......?.T.+H.I.u.....~.cU.yTUq..pO....&=9.....X........RG...?b,....JY....8q.n.f/.<.@.... i;.@D.r/..-.r?.b-...]..g..e...wj.o...Ux"........6.o4...w.b......u.!j&<..`.M..?......._D}.~...@...eM...VJ..6>.....c.........%.q..6N0......!C..A..,o7..;.r.kE..>...aX.w..;p.!*{.6P.H........`o......-.n.|.O.\.=]g^b.'.rU..........2.......6.r&.%......O.U.s.X....vyP.E......F.l.e>J..z.0$...O...R..........r..FRL[..g%_r......

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av-vps\product-info.xml

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe
                                                                                                                                                              File Type:XML 1.0 document, ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):5930
                                                                                                                                                              Entropy (8bit):5.110774122127088
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:96:aVI9OLifZbKIB3CkOMsUzQoVNVVKW9jbXfPMef2wjzVgC+iM:a69OLifZbKw3/OMsUzQoHVVKg3XfPMee
                                                                                                                                                              MD5:C8E8E4CFB6DB62D53931666FD856EE7C
                                                                                                                                                              SHA1:64CED5408CE2F48FCE09769251A427ED012DBF9F
                                                                                                                                                              SHA-256:218F5384EC37F48255A877E129D8B6C1FB9B13978A738C162003C003F51B864A
                                                                                                                                                              SHA-512:2200EF836D506D67FC2811594BB2646FA8961ACCBE5214A84B42B9E9993F026F6DA13D87F8973ACBA1C41829140A7E9C9FABD4E0916DA5C8E494ADB5E340ACF1
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:<?xml version="1.0" ?>.<product-info xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="product-info.xsd">..<name>avg-av-vps</name>..<version>24.7.1806.6883</version>..<build-time>1721311828</build-time>..<inner-version>24071806</inner-version>..<setup-files>...<file>....<conditions>.....<os platform="x86"/>....</conditions>....<name>icarus.exe</name>....<src-id>69c9de9f0cc9cc846d44e8b9a42de17d93f4cde9ffcf7a10d1dff69c4cef0c1f</src-id>....<sha-256>4344b8934113835a89d0722d8e4014a7af7229b1699c8b301acf5af86abe4350</sha-256>....<timestamp>1721311776</timestamp>....<size>7133624</size>...</file>...<file>....<conditions>.....<os platform="x64"/>....</conditions>....<name>icarus.exe</name>....<src-id>cfab5808bd7503ee1aff23b54d5a98a557524fa453762afa10b90e4b7ca6af95</src-id>....<sha-256>26d05ee137d76b2266d2b907b584b908661f07fad791ebb1a355c5378d9af775</sha-256>....<timestamp>1721311777</timestamp>....<size>8027584</size>...</file>...<file>....<conditions>.....<os

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\aswOfferTool.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe
                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2453952
                                                                                                                                                              Entropy (8bit):6.785608960819034
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:49152:OEcQggggMAjlsRe/Na1CS0sAvAfAAEV1rnFTZT0krlGW+:blZsRSNa1CSvAo7ELxTZT0krg
                                                                                                                                                              MD5:E771D9772EBC6A5A15B0EA9E4A64BA7A
                                                                                                                                                              SHA1:F36375BE540AB9831D546F007CEE5582DFA55520
                                                                                                                                                              SHA-256:DDF9BA1AA5130A36A4ADAB9FD7F28EA3701807C7AEC98514E83C561359C12F00
                                                                                                                                                              SHA-512:F1AD59D9468852D341563CBF42CA707B416E685866D2CFD7E74F5D4A0AE211376533419C8FB052A1BEBFCEC52852AF6DD9FD22AAC47983D05B04D3173198B2A9
                                                                                                                                                              Malicious:true
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.........O.Q.!.Q.!.Q.!..."._.!...$...!.W$.Z.!.W$%.E.!.W$$.1.!.W$".J.!...%.I.!.X..S.!...%.K.!...%..!.Q.!.W.!...%.W.!... .L.!.Q. ..!.;$(.!.!.;$!.P.!.;$.P.!.Q...S.!.;$#.P.!.RichQ.!.................PE..L.....hf...............&.X...................p....@...........................%.....|.%...@........................................@.............HH%.x)....$.8.......................................@............p...............................text....W.......X.................. ..`.rdata..*P...p...R...\..............@..@.data....l.......F..................@....rsrc.......@......................@..@.reloc..8.....$.......$.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\aswOfferTool.exe.lzma

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe
                                                                                                                                                              File Type:LZMA compressed data, non-streamed, size 2453952
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):925188
                                                                                                                                                              Entropy (8bit):7.999805272546769
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:24576:r6y8ygisxv5O+xvRSssQFiob3AqGrVP5raa:rJ8visXfnhLXGJPEa
                                                                                                                                                              MD5:9CFD256213C0440D76ABF9E45E8E015A
                                                                                                                                                              SHA1:7EC01E0CE015D81F1C1A574EEDDBB6959ED5A08E
                                                                                                                                                              SHA-256:5F8BAD8B191983BA34B9718701ED3EFF5762211052D238558F09F59BF5D8B0EC
                                                                                                                                                              SHA-512:76D0FCCC7E537D15E1C372B426480A1107860F00436F84D5366F34ACFF651B07A34C145F3BC082AD51A58ECB55B5290F0C5A0A05C39AB259AA07EC8FFFB20885
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:]..@..q%......&..p.........../D.|..b..6>..p.}#......G...)p{` ..i=`...k.<....G..7.p..C..K.N.........<..W0.?i....A.c..@..4......[,...a.QI.&.........[Z........#...qh....V*.z.ky....RK_..`........q.#.b........2'.E..6...Wp.....:.Nv.../..Yfnl.D.$B.....=.....rYH .....A.Y<&.p..s...`.../fVoB.3....zF...:o$,|%6.I...b.X.!...Z/.-.i.../<.mm%.?b\f...y.x.A.3...h.A.....H.....~.}..I!g.v...8c.9.%.........w..W..a.=..N.3j.N($Gn....z"3...&.H.......\J.G(...{...3z..y.......C.<$1.C...QV`LVUQg..>.OA? .0%v--S.HHPt..kQ.Q...:.P..........L....1h.b...)..H...........D.<.^.(Fc.V....FK......Ae.9dA..>.....;..n.[.>.Se....._......|.............*....$9..G.rs.......%+...h..?%.b.yIV..t.b{0&.p.!...E.)...aq.[>..B....7.H....!..`.'......=.%..I.`VQb.l.CW........a&4N^.k......q#.d.....]z1.....PJIC!4.@g.q...Q.(Ob.h.i..Q.......m...Z.P....Z...D&.v..9..R..$...T.e2.A#...P.-pN.h+`.RA'.>`.......#...5.....r.\..&:xc-.6.9.x....[.)....&m.:g.tL.;y.Ws.8.._...Y*.....8.e0.....d|..>*.l.r.|....e..

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\bug_report.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe
                                                                                                                                                              File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4903360
                                                                                                                                                              Entropy (8bit):6.522876423141521
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:49152:DMLOHWldqr5oquLxYTOf27AlAFn/vyYBnYvrlu8Mx6Nfsmr0DkTyY+JR8UyQ9UsU:JaY7AElYs8u4RnZQzHUI6/NyG
                                                                                                                                                              MD5:B269C45CA54AF5B57A5B2115D9CDB8D5
                                                                                                                                                              SHA1:67D886792DF5B3F718D5AF2D77A3AA0532CAE1C9
                                                                                                                                                              SHA-256:D9367C5E474BCA83CB06F583F2FB42EF2517D769CC82722201A0902C0B90A32A
                                                                                                                                                              SHA-512:2DF04CD928F2E9C871C5CCDA5F033F784CC32385A94A4EA1D8A204F9DC335331FC65459387F9C24295155E0EA39FFDE4A38965653968048D45DBAB76E7F06106
                                                                                                                                                              Malicious:true
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$........H..T)..T)..T)..[..)..R.$.X)..R...G)..]..])..R...#)..R...F)..[..D)..]QJ.V)...\..N)..\...)..\..U)..T)..Y)...\..|)..[..p)..[..s)..T)..6+..>...6(..>...U)..>.&.U)..T)N.V)..>...U)..RichT)..........PE..d....hf.........."....&..2..4.................@..............................K.......K...`...........................................@.......@.,.....K.......H.HO..H.J.x)... K..f....:.......................:.(...p.:.@............02..............................text...,.2.......2................. ..`.rdata..v....02......"2.............@..@.data....|...0A.......A.............@....pdata..HO....H..P....G.............@..@_RDATA........K......6J.............@..@.rsrc.........K......8J.............@..@.reloc...f... K..h...@J.............@..B................................................................................................................................

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\config.def

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe
                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):757
                                                                                                                                                              Entropy (8bit):5.407720307097613
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:2AcW1OPqygAieSOZI+xzYN/qb0a3Uk7oMQuROfzXy9FQV6UaAAOheM6/QtTWJtzX:rVASOZI+dsqNUk8MQuALC9m36/xJpPqk
                                                                                                                                                              MD5:26C276EA2D6B073451E08576A159A2F5
                                                                                                                                                              SHA1:040BAD1070B1742469D5A6244CD2699E8E0D7D31
                                                                                                                                                              SHA-256:BB8244553B8135846A2F3DE384995378D6E3CB52BA6DF2078DC09A9152896D90
                                                                                                                                                              SHA-512:A14FAD99C0A5D6F67439CDEE877DBE264288D2E984D063C76B7C5A7C443B3847CF8152CBEEC49F595A61E3DD9FBBC13601A7E6FADD8E859B82908DB16C23F515
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:[ui.offer.actions]..url=https://ipm.avcdn.net/..[ui.offer.welcome]..loadtimer=10000..url=https://ipm.avcdn.net/..[bugreport]..product_finished_errors=258,45021..[reporting]..disable_checkforupdates=1..report_action_ids=RID_001,RID_002..[common]..config-def-url=https://shepherd.avcdn.net/..report-url=https://analytics.avcdn.net/v4/receive/json/25..[ui]..enable_survey=1..[updating]..conceal_hours=1..fraction=100.0..updatable=1..[offer.browser.asb]..decision_type=2..download_url=https://cdn-av-download.avgbrowser.com/avg_secure_browser_setup.exe..enable=1..priority=1..ui.offer=welcome..[Signature]..Signature=ASWSig2A03526D6B218414BD4C43CB46ADC95F95E0328DEB97C93637625B8BFD3B08BB7D67E4E9B4B90EEEE305B8A2CD2F1B51C6BA4668C4A03A06CD199027D053AAD56EASWSig2A

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\config.def.edat

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe
                                                                                                                                                              File Type:ASCII text, with very long lines (2186), with CRLF line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):21119
                                                                                                                                                              Entropy (8bit):5.687833838091762
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:DHJ7eXHtHcV2g2Ji0YklA3V4H3p+aTiBG1srr7dl9D3eJc8oaKAd:t7e9HrJibF4HuBWw/D3em8orAd
                                                                                                                                                              MD5:E16956D111D674A6D37ADE3B7DD63B1C
                                                                                                                                                              SHA1:BE435DDB156451A6417D42299D91D4972A34A9B3
                                                                                                                                                              SHA-256:67DD20872EC1A4E1E12F66C3C5ED6D9E6543ED2857739086F3B0492700BA6C40
                                                                                                                                                              SHA-512:2073B684B192C183D666EFD4F635FDE258FB469EAF605D23B9462EADE867730C070A47829A47C63E64C4D697A8923544A5DE37B6616BB8E2AEB12A9885D82231
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:[RemoteAccessShield.Setting]..BruteForceMaxAttemptsPerDay=60..BruteForceMaxAttemptsPerHour=40..BruteForceMaxAttemptsPerMinute=30..BruteForceMaxAttemptsPerTenSeconds=12..[Settings.UserInterface]..ShellExtensionFileName=0..streaming=0..[WebmailSignature]..GmailEnabled=1..MaxRequestSize=16384..OutlookEnabled=1..YahooEnabled=1..[WebShield.NXRedirect]..Redirect=0..[Offers.GoogleChrome]..DefaultState=0..ShowInComplete=0..ShowInIntro=0..ShowInPaidBusiness=0..ShowInPaidConsumer=0..ShowInPost=1..UseTryOffer=1..[Offers.SecureBrowser]..ShowInIntro=1..[Settings.{D93EF81A-B92F-27FE-AF54-9278EA8BF910}.const]..ScanAreas=*RTK-SUPERQUICK;QuickStartup;QuickMemory..[AntiTrack]..Enabled=0..[FileSystemShield.FileSystem]..EngineLdrModuleFlags=24..[Fmwlite]..License_check_interval=16..[PerfReporting]..AvastProcessesWprCaptureInterval=0..[Components]..ais_cmp_fw=2..ais_shl_spm=3..[GrimeFighter]..info2_licensed_period=3600..info2_unlicensed_period=3600..LicensedClean=1..UseGF1License=1..[StreamFilter.HttpPlugi

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\dump_process.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe
                                                                                                                                                              File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):3492792
                                                                                                                                                              Entropy (8bit):6.523436707758999
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:49152:uGI2edLDbg8CcP11BLLJS+wlOwE2PdBZaZu9TpHxHcQ66OYwV8lArtYtPtRaJg16:uB2grL3wdTjoQFO9A5Xo
                                                                                                                                                              MD5:FCA231A72F159864EF730897768FE097
                                                                                                                                                              SHA1:2C29BCA3BC8F8FC5E86D35FD2CB91C0176CA309D
                                                                                                                                                              SHA-256:9CADB56DC6BDEF59526A6ACA8423FBDA0000124BF15228CD536BB178EEEE812A
                                                                                                                                                              SHA-512:FB4F1BDB2A40E02B10E2D8A290F9BEE19D4CCBCA33C0B9A056A0FB0536035361B853614DD1807461429B1AAFFAC034F26FA4E35EC01C04AD2D7423CC90A0D47F
                                                                                                                                                              Malicious:true
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.......5...q..q..q.....z...........m..wy'.r..wy.c.....x..wy.e..wy....x.I.s.....p..q..v..'..r.....h..q......y.....y.p...y%.p..q.M.s...y.p..Richq..................PE..d.....hf.........."....&." ..........8.........@..............................6.......6...`...........................................+.......+......@4..Y....2.....H"5.p)....5..U....&.......................&.(.....".@............@ .@.....+.@....................text...L! ......" ................. ..`.rdata.......@ ......& .............@..@.data... .....+..$....+.............@....pdata........2.......1.............@..@.didat..P.... 4......n3.............@..._RDATA.......04......p3.............@..@.rsrc....Y...@4..Z...r3.............@..@.reloc...U....5..V....4.............@..B................................................................................................

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\edition.edat

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe
                                                                                                                                                              File Type:ASCII text, with no line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2
                                                                                                                                                              Entropy (8bit):1.0
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:Jn:J
                                                                                                                                                              MD5:9BF31C7FF062936A96D3C8BD1F8F2FF3
                                                                                                                                                              SHA1:F1ABD670358E036C31296E66B3B66C382AC00812
                                                                                                                                                              SHA-256:E629FA6598D732768F7C726B4B621285F9C3B85303900AA912017DB7617D8BDB
                                                                                                                                                              SHA-512:9A6398CFFC55ADE35B39F1E41CF46C7C491744961853FF9571D09ABB55A78976F72C34CD7A8787674EFA1C226EAA2494DBD0A133169C9E4E2369A7D2D02DE31A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:15

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\icarus.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe
                                                                                                                                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8027576
                                                                                                                                                              Entropy (8bit):6.455870084278652
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:98304:Q8/LrPXdY6YRv8coX6f6pnpnaoi+Lu7nxTIng3t1uw5:Q8/LrPtY6Yt8qypnaoi+Lu7nxTIg9n5
                                                                                                                                                              MD5:251369428A0E2D87308E7A9FAA387270
                                                                                                                                                              SHA1:89556991DBDE37BD48CED113209BF451F7E4E74C
                                                                                                                                                              SHA-256:2445F8A0B75BEB1A77428C2D605189876222FB9D53E3B187F7B7FE8ABE3386C0
                                                                                                                                                              SHA-512:B720C02C0A359C10163FFBE8D00B456DBDBD26AE4C59098FB454CC3AB2ED4E9D710114ECA3818CBBCA201CF8366897D8BAC213E9B0A5A677CD4453B7BF7EFE5C
                                                                                                                                                              Malicious:true
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$.......................+../....(c......(.....(.....(.....+....+.....b......b................2..f...:....................+......+.........|...(......(......(a.............(......Rich............PE..d....hf.........."....&..T...%................@.............................p{.......{...`..........................................\l......]l.......y......Pv.,U..HTz.p)....z.......a.......................a.(..../Y.@.............U.x...HYl......................text.....T.......T................. ..`.rdata..$.....U.......T.............@..@.data...`.....l.......l.............@....pdata..,U...Pv..V...nu.............@..@.didat..p.....y.......x.............@..._RDATA........y.......x.............@..@.rsrc.........y.......x.............@..@.reloc........z.......y.............@..B........................................................................

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\icarus_product.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe
                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):6207936
                                                                                                                                                              Entropy (8bit):6.48668883802957
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:49152:MMLnHkldZCMWEiY1X1w1RtKzA6lRzrMDntJCvoZ7HfyRypQAcQ632bM+UKA5cvwt:ONDiiER6MpH6RwQNo4cM/SZ52WeT
                                                                                                                                                              MD5:3F4BDB3FA0D5BC6F9CDBAE36115E952E
                                                                                                                                                              SHA1:E6A7DEF41028CA6A154163E12CBDF1131F2C92FB
                                                                                                                                                              SHA-256:95E7E44DBC8F6E4362D00031D403F24FE15918251C39310F40A9E2634549958F
                                                                                                                                                              SHA-512:D41E069128800FC7004ABF63143A20928995841FF6429D8D7E99AA2860F9EFC6884E2F250FB17CCF8EB633C766C7C88673C542056DC1783C1E464D6CA6B5AB5D
                                                                                                                                                              Malicious:true
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...................................x...........!..L.!This program cannot be run in DOS mode....$.......Q..r..~!..~!..~!..{ ..~!..{ ..~!...!..~!..z ..~!..{ {.~!..} ..~!..} ..~!...!..~!C.z ..~!..z ..~!C.{ =.~!..x ..~!..z ..~!..} ..~!..z ..~!... 8.~!...!..~!..z ..~!..{ ..~!..~!..~!..z 2.~!..w Y.~!..~ ..~!...!..~!...!..~!..| ..~!Rich..~!................PE..d....hf.........." ...&.L>...!.......$......................................._.....U!_...`A.........................................R.......R.h.....^.......\.L...H.^.x)...._.....P.J.......................J.(.....J.@............`>..............................text....K>......L>................. ..`.rdata...n...`>..p...P>.............@..@.data....2....R..r....R.............@....pdata..L.....\......2[.............@..@.sdata........^.......].............@..._RDATA........^.......].............@..@.rsrc.........^.......].............@..@.reloc........_.......].............@..B........................................

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\icarus_product.dll.lzma

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe
                                                                                                                                                              File Type:LZMA compressed data, non-streamed, size 6207936
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1751143
                                                                                                                                                              Entropy (8bit):7.999903826091739
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:49152:A6LrNLg7M1149o2kI1jzszZuDMWOQDpkz:ZfUc1r8DMNwpE
                                                                                                                                                              MD5:A64D2983AE23C18E2F4EC2DE979A6872
                                                                                                                                                              SHA1:6E40A4A9836B0807CB3CDE9E9F23F99EFF87AB17
                                                                                                                                                              SHA-256:89A00467D45AE36AC61E7F019194D38841EF658C405D8C3E941734A6C816B63F
                                                                                                                                                              SHA-512:7024746FF896960E5F66C9F14966D14E395F68D10DFA1BCC8A53190AAC228EC18FC4A91CBF4A7AC3392AEC2090963E95EB5FBDF46128F8865BB9AA604497F6D4
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:]..@...^......&..p.........../D.|....e.I0..y.]n.u......i...7.....B]......F2$1..../e.Y.....f.$.{.HE.a......../q..Q).4.......c..]*x.F.;.Q5.(..q..+:._4.....f^.@js.s..r."...r...k...d.Z).4..!...L..S.....4i.S.I.W....>...uo.;...*X....].F3....,1p.m.....MPlkV...nA..2...]..@..,.a...tY.B.`a..3.WnZ+.X.).'..?.....B...J6.W.(y....W.!..L.7.2./.ND....MJ..Xu..&_@...h:.."...9...7.wz}........mm.@=^?.r...o.Gl{..E.A...w..DX..{h....J..\c...../A.......r...o.).4.s.^.+.y.p.ANI.WWp6.%.qn3.Y.p..9....$...w]...1..4_5.M.......{.R..,.7.ii...~..i.....".....H.zW..|.....s?.\.W.2.(.W_N.....CE.:O..g......:.$...P? q.;....(.1.....S....G%....].C....+..1.....?...u....H...{.].q.gkBF.c.. .y...XYF.A.v.XR...}.n4DA...........*....:..5}$4......u.i.i^*B9...m.GC..i.b..9.4..j.[,...}K ..0'L.......b!..4...}7.....Q....s..b.....r!93.E4...6D_h...+....!W?..T...[.a.....n!.. .gu`.\.U....G...nGya..]...`.q......[..#.~...g.....As......(...j..-.......NMY.....Z...r..p....0..{&...B^.....|7.

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\icarus_rvrt.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe
                                                                                                                                                              File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):50976
                                                                                                                                                              Entropy (8bit):6.695978421209108
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:6fMVFuX7Y1C7X+oAiZ8uMX07F9Kx24Zza:WMVFsSC7+K8ua0qm
                                                                                                                                                              MD5:97F5D0CAAA1988C95BF38385D2CF260E
                                                                                                                                                              SHA1:255099F6E976837A0C3EB43A57599789A6330E85
                                                                                                                                                              SHA-256:73EE549578DED906711189EDCEF0EEDBC9DB7CCBD30CF7776BD1F7DD9E034339
                                                                                                                                                              SHA-512:AD099C25868C12246ED3D4EE54CEF4DF49D5276A5696CA72EFA64869367E262A57C8FF1FB947AD2F70CAEF1D618849DBAB2EC6161C25758D9F96733A7534B18F
                                                                                                                                                              Malicious:true
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................r.............../......./b............../......Rich............................PE..d....>_e.........."....%.N...(...... ..........@..........................................`.................................................\u..(.......8.......P....x.. O...........l...............................................`.. ............................text...)L.......N.................. ..`.rdata.......`.......R..............@..@.data...............................@....pdata..P............l..............@..@.rsrc...8............r..............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\icarus_rvrt.exe.lzma

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe
                                                                                                                                                              File Type:LZMA compressed data, non-streamed, size 50976
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):26032
                                                                                                                                                              Entropy (8bit):7.992977293575329
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:768:dXkqelTjZK0JgHW7tbzdiH2P6AdRo7+lmAg:dEfJJZtwH2PJbuUg
                                                                                                                                                              MD5:F13E71BDBBA9A80351A786C44272F737
                                                                                                                                                              SHA1:DC8F9B86B56684F3A7BD7DBB16DC27B436735E97
                                                                                                                                                              SHA-256:7E7DF8B8EF9226E9E916199D8721E52D8737654D6EC5A8A3B11B49CFA6633D34
                                                                                                                                                              SHA-512:2D8BF0BABE54618CD81212990BA9975CEA64C5E51172DAB95004364229B0A35190F94DF2E37FC70E93DF2A24EBC2339BD0A8801411ABE1F98915E6873562E7FC
                                                                                                                                                              Malicious:true
                                                                                                                                                              Preview:]..@. ........&..p.........../D.|...G'_..z.-~A..\..*~kHy54......<.....=......6......! o..- 6Y../.e+.Y.1~...~y. .....}..N..H.)G'P0..K..*..?.."...c.|..p.z.m!*..D...P.X..@~..E.B.T....5.7o..Y[C.......1.f..]?.........*......W....z.V.b}.H....h0......>./...w.K..}.o..Tm....V|.2.,f.U.......C@.]..e_.&....3....5NC.:.Tm..A3...:.q'Pj2}.m...1k.s.T....O. .....sq.&PaB...=.F.f.F]..;..'...W....{i8......Ki.u.i..2#..*....L.........F......~..x.W..@.J..X..*.'....0t.g.B....b....Z...@~<...8QZLR..2>_.X....=q...%..r*....oP......B.*&..wjV.........`..-..K.=.&r....*....Mi...q..{!..P.aF........-)D.9...r.iE..3..Q.....}.'....o.VL.3.].fW...,......R....<.P.l./.>.%3...{K>...=0..m.B.....f.=...E.^3...."n{.kw..-./-.,..D.d0..$*...rq$...=...g...._n~...H.....p.I..e..U..(._.5.W..y.7.r.^......?|h..\;$.IW....E..N..$.....>..:..."....v.`Jya.MF.\.>.N...\.....I.m.*e.+.Ut....._...xo.[$.M.Q..V_..X.~.XO..'M;.*.(.@....X.d.{..g...0Lx.C....*......`w.o].....O5.'..Y..........y:}..w.....$.b.{....b..IJ..

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\icarus_ui.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe
                                                                                                                                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):12243384
                                                                                                                                                              Entropy (8bit):6.579558539578861
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:196608:REzSIoqUp+rqPDQE9J9CGZDsALgiL9vnrqNAQC:qzSIojQE9fCywifLZrqNAQC
                                                                                                                                                              MD5:A8AC4E9FC79EF367D788F434D8E04D45
                                                                                                                                                              SHA1:827F9A298FC35D7A63BB6550A5AAADE7207FDD84
                                                                                                                                                              SHA-256:4D26A67D9FB882BA9DDB9A8F90CFC0A1F17C5F526ABB83671F6B958F1BC3CD05
                                                                                                                                                              SHA-512:0EE5405C95DBDCF82811866211E48D147837480E86CB5E724C285E382D7999164C15E5D60F3824A9D4979C301A781FBDA0895E25DB7169B5EB81CF4A95547B29
                                                                                                                                                              Malicious:true
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Preview:MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$.........) OzGsOzGsOzGs..DrRzGs..Br.zGsI..sFzGsI.Cr[zGsI.Br?zGsI.DrYzGs..Cr.zGs[.Cr.zGs[.Br.zGsF..sMzGs..CrNzGsOzGsHzGs..BrLzGs..DrMzGs..Cr_zGs..FrzzGsOzFs.yGs%.Nr.zGs%.GrNzGs%..sNzGsOz.sMzGs%.ErNzGsRichOzGs........PE..d.....hf.........."....&.....a......D.........@....................................u.....`......................................... ........................p......H...p)..................................."..(.......@...............`............................text............................. ..`.rdata..n-%.......%................@..@.data...._4.........................@....pdata.......p......................@..@_RDATA.............................@..@.rsrc..............................@..@.reloc.............................@..B........................................................................................................................

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\product-def.xml

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe
                                                                                                                                                              File Type:XML 1.0 document, ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1318093
                                                                                                                                                              Entropy (8bit):5.392833517738244
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6144:5aoorSmXIqrauc6nrs6cwSkxNRdCJB9Crg5bMdrDWT1JyJIWp:5aoorS8cH6ZSkxNRdwB9sgb6HW7yJj
                                                                                                                                                              MD5:A61782BF711E98C41336C861994A5A65
                                                                                                                                                              SHA1:306964C8A142B3A6E0E826CCA4DB1FD948AA9C81
                                                                                                                                                              SHA-256:26032AE10582074D1B38F8AD95372CFC56CE273D7A2766B2A0DDEABB1E90BF0F
                                                                                                                                                              SHA-512:428CF6A6D5F5D56EF94BC48D8975398155F6B4A378AD29BF49A28C5D779E894BBAA9F406A46CBE45252A3CA8A1F0AF97AD20F1AAA437C66FFE44534B6F00390C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:<?xml version="1.0" ?>.<product name="avg-av">..<product-defs>...<config>....<install-folder name="Antivirus"/>....<program-data-folder name="Antivirus"/>....<registry-key name="Antivirus"/>....<full-name name="AVG Antivirus"/>....<languages>.....<lang>en-us</lang>.....<lang>cs-cz</lang>.....<lang>da-dk</lang>.....<lang>de-de</lang>.....<lang>es-es</lang>.....<lang>fi-fi</lang>.....<lang>fr-fr</lang>.....<lang>hu-hu</lang>.....<lang>id-id</lang>.....<lang>it-it</lang>.....<lang>ja-jp</lang>.....<lang>ko-kr</lang>.....<lang>ms-my</lang>.....<lang>nb-no</lang>.....<lang>nl-nl</lang>.....<lang>pl-pl</lang>.....<lang>pt-br</lang>.....<lang>pt-pt</lang>.....<lang>ru-ru</lang>.....<lang>sk-sk</lang>.....<lang>sr-sp</lang>.....<lang>sv-se</lang>.....<lang>tr-tr</lang>.....<lang>zh-cn</lang>.....<lang>zh-tw</lang>....</languages>...</config>...<vars>....<var name="%V_PRODUCT_PREFIX%">.....<desc lang="en-us">avg</desc>....</var>....<var name="%V_AV_SVC_MODULE%">.....<desc lang="en-us">AVGSvc.ex

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\product-info.xml

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe
                                                                                                                                                              File Type:XML 1.0 document, ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):9649
                                                                                                                                                              Entropy (8bit):5.276039758494122
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:UOMG3s/wDmND+zBiFTWoQsUzYoHLV1xUQ28bX8ecFXOBmURzfHWpjs2:UjjwmN8Y9Y1vbMeeuB/W5P
                                                                                                                                                              MD5:1CD82588F7C425083E7C2DF8D3A635DA
                                                                                                                                                              SHA1:4C075D43B104D3BAD2802E134844D64CAF12998F
                                                                                                                                                              SHA-256:275E2B5FDA8C7924DAC945914CA156E4B5A6D7C76947D7299A7B907D798DE199
                                                                                                                                                              SHA-512:F4E142F52A584324083F411B02E9189C5462C40C9A13D16808FD0ADBE4CFA36EA01DFCACFBA5B4E935CCF490FCA5D4BDF0B0A5D11B2B5EDDD51E5325F26FF5E4
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:<?xml version="1.0" ?>.<product-info xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="product-info.xsd">..<name>avg-av</name>..<version>24.6.9241.1898</version>..<build-time>1718902903</build-time>..<setup-files>...<file>....<conditions>.....<os platform="x86"/>....</conditions>....<name>icarus.exe</name>....<src-id>69c9de9f0cc9cc846d44e8b9a42de17d93f4cde9ffcf7a10d1dff69c4cef0c1f</src-id>....<sha-256>807a5c7427f19f75f3721e775cce423aa31bd045b9d14bcb47f77613fe877a52</sha-256>....<timestamp>1718902876</timestamp>....<size>7133632</size>...</file>...<file>....<conditions>.....<os platform="x64"/>....</conditions>....<name>icarus.exe</name>....<src-id>cfab5808bd7503ee1aff23b54d5a98a557524fa453762afa10b90e4b7ca6af95</src-id>....<sha-256>2445f8a0b75beb1a77428c2d605189876222fb9d53e3b187f7b7fe8abe3386c0</sha-256>....<timestamp>1718902877</timestamp>....<size>8027576</size>...</file>...<file>....<conditions>.....<os platform="arm64"/>....</conditions>....<name

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\avg-av\setupui.cont

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe
                                                                                                                                                              File Type:XZ compressed data, checksum CRC32
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):390836
                                                                                                                                                              Entropy (8bit):7.99951433163968
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:6144:4w9cqum3uw3JWjgdFLPD4kE+TSUT7vyeW7fx+QNNsynAdWjqggVim0sM84vcYkAo:4PC3dwgdFYktmUXMoryQWjpgVimxMDvu
                                                                                                                                                              MD5:8F4BC5B548488BE6E6FB1F25CA839B65
                                                                                                                                                              SHA1:E1F5831F3DDDECEB7D75413A64A0EE19077D1A78
                                                                                                                                                              SHA-256:9FCCF24557F7691F06726FA651A35B48BDBAC4556CB63188CA7C8030C0426934
                                                                                                                                                              SHA-512:7416A9B9D55DDAFB16B5FFE7393E3D9D736A02CB0D57EE795103067304615D2796405D00A89782B83EDC7A70722676FC571581AD58FFEF9978635672441DA92D
                                                                                                                                                              Malicious:true
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.7zXZ...i".6..!.....F.;...2.e].0...?..Lm.K%. .6.X.....L.@#........EG.I.....}0.B..r}...&....c...B.+..).y>.....e.g.....H..`.O4.z=5..../1....n[f.k.S}.W.Gk...o.......-......C...._.FVc.......Uv$.<.Y...#.....3:^.O..(&00....q....99+...].M.u#s..HO.z59.I.]...a...%k..I.vd"..-1..n.Y".h.vi..L=..5]..=..<!..d.....D.....A.<....'h......5..;V.........UI.{$..U)..u.....W3.e.,!o&p'.2(..?.k...x..aB-T..6..1.q9.z..?...g...Mb HT|......3.....!ikY..I..8..{.>....:..i0'.l,...(...b.`.-./.:d..~l).l.^..@.....45.Y....._4...v.(.-..M..gu.#Q .1_Z...>v..Q.,.#.mG.....V...?.5-.M.AIb.6s...d..#.mA.4.....tySS.`o....._^.Y..)..Y....RX.u...Jz.d7S.l..P.H.EF...B..)...@.._...Ms#......._..r6.8q..g..........?'...@^K.B5..w...s....8.J....B........j.( .w..h_..n........._..&'G..8.%W.....v-.:.m.e"H@..6.....*..oM......."..ckp..Ma.!2..pTw...q.B.9../...cy..Zb..=.U...\,.d.2`.a..a..2b&2.%J.<w-V.d.O..7...5.i.......uH...I..]T^..1...,...<2.tTa..}.i...cJ=[.nD.... .@..i.0+.........Y...[..Ej.w.......L.[.;..

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\1802c68f-2f28-4075-9083-9e338a0c19c8

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe
                                                                                                                                                              File Type:LZMA compressed data, non-streamed, size 12243384
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):3969541
                                                                                                                                                              Entropy (8bit):7.999956197263596
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:98304:DZXqemNwH+rEmPrux0t5gh936QBxMftBi9U3E:OwH+rEmPPt5u3Rwi9U3E
                                                                                                                                                              MD5:B0E2D85588A72DD893DB803976A30694
                                                                                                                                                              SHA1:F345A30C3446465A7B6848777251DC0755F67323
                                                                                                                                                              SHA-256:62D8B56A47D3BE77DCAEE0C820A06178EA2B451D90D7C73F8B394D74492D7F48
                                                                                                                                                              SHA-512:186863EBC1746279BB08394A30538C0FF0086D10B1205D22D7DE81859FB6C6077A4FD44C0EE92C81F3341D541BED7B386ABAC54FF0812B911A3646FFB4BBBFDE
                                                                                                                                                              Malicious:true
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:]............&..p.........../D.|......e.F<w.,...vY.Ta.....NE..1E...V..Z..m9..^../:Y!....y....eg......a+`n.h>.&...) .........|.y.EP.w.ls%Mq..>}_.......=.9..~..H..c..(.A.1..D.x...jI.J..y....2|..@..y...t..U......]a.....S|..-D..J..y..../...}JA.eA=d....-f...W..V.y(..a..nm1...._,l...d..u...r.....(...}..rA7.sn.;.!.....B.K. .. ../..UA...(.z.PrS....o.K{|J...L....]+...mk...8+U......u....4..8C..B!`.9.U+N.t..Q?...._:.e..G.u..w.....r....u...:.-3..AyH.N.).E...su....I...k.=..T.0..f{E...}...d...l.X..j.(...M/.... ....wo?.e. 2i.......Z.Q...m...D.v....O........T.....O8P.e.@.Ly..?.....M0.I.jv...0.8...$Iu.x..5d.bU..yCM..==zO.l.{5.Q. .B/Q..i3D./.....;Ja^..>.de..j...d,...J._My\...?S>-#.\'..T.\I'..0V....)...[.}4.9...}..`nK..+.R&..+m0..j?"..$..<...._..........}...-.A.....O...j....-..<z.f.e.....L...]r.......}..7........w..o...Y#......XR..?...`R..{....:...9.r..(\..e.M.,.. z..@.....8..........h..6.`"X.9.F...r.......Q.%0..l...<...4.q.....E.. ..y"..%(.zI.i.........{.

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\645cb7cb-fd81-4ba0-9161-5880e64c7118

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe
                                                                                                                                                              File Type:LZMA compressed data, non-streamed, size 390836
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):396296
                                                                                                                                                              Entropy (8bit):7.999486505642195
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:6144:DkAHC7P9QZuN42OIe9p9h0y9R6j3WBxbPAIBVP/bJCTi8l72FZ:DZHCd42OIK90jbWbVbwTfl72f
                                                                                                                                                              MD5:88C8E42A12EA10DE82C9741E96C59018
                                                                                                                                                              SHA1:B477495DC1B815153075A305599ABDCCC125DB9E
                                                                                                                                                              SHA-256:9CEC40C4F471BEDB0C3D20ADD43A85969730FA05746973DC95A63138330C6A7D
                                                                                                                                                              SHA-512:D79C9D996062E9C7CA14ADEE8986283021EE41220BE3EE661829381D78A19A5FA74BF44279FBC3B365DC8FF91A6F71EF6FE3F8EBE699B232B61DC845DAF723A7
                                                                                                                                                              Malicious:true
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:]..@..........~..E..8... .rZ.~0.eg6.....Rv..... fe..b.r..h..u]....U.FK?+.UQ+.{.....e../..P.!..I6.f6..>Pi.?....0.o....W..%.KFL^.w...i\.v.....XLV?...W..A...N6@..5;.T...f.Tq..].....bjT....|0.Z..U.....,.'.y.......eY.DG3A7}......|._..)...4ZA/D..!./'....H.7......$....t\N(oK.nB>o../...).X...'Im...c.....XK../.j2.O....d..)..........:..^.i..<9..........;k.C.'M..{ge.^..-%...<..c.bp..~. .....n.}..)....vrQ..:U.,?..j.E......lj.H".yA.R..NyW.....\.gl....W....8Vw.'d.F.xY.4..P..m... ..l...<.cl...t.Y...;."....z7............O....9."J,...1.T..~..)..F..I...IvQ...g....x0C...t4....{...}.{.r...y..O.(..}";s|...Uw^..A....(.n2.$q....N.b..D..4&.aWl.._.cD.T...a.F'.-5h...b#q.|/.(.s.$.w@...F.SBiq...B.F.......d....IE..V..zZw.....F...F1.e.*.j.. v.]9`..0..s<8_EA+m...HB.D.5P.......f[.C:bt.B...)p..L%..P..U...>=...j:.....;......7.....Cg......m...$.._..A.j4!.H.:..[.."....dq.h`....HU.9.%1..Q...Q]b....l'|.A*....94....0H.DLK.....O.4.:........-B......x.E..*.s..[.|

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\9075e8aa-52b9-4d0b-8d82-eceb08093b03

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe
                                                                                                                                                              File Type:LZMA compressed data, non-streamed, size 15288
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):9568
                                                                                                                                                              Entropy (8bit):7.978870584573958
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:qAMPsNkYjkydT90b8z63HjevRK36wTDF+8rk9BdliZ2Tpqxt:8EOYjky590b88jdPF+84BLqxt
                                                                                                                                                              MD5:FB9FBA796A334A0FAAC0357771F24332
                                                                                                                                                              SHA1:5650EF5A38A61F41CBB37E4A63E00536D19008FC
                                                                                                                                                              SHA-256:A155D1A1917ADE8CB53877A578650EBA018745E165253E1D546A4901FC1D4A64
                                                                                                                                                              SHA-512:96D7AA217969E4F843577840EB5F1DDD4B54265FA84E24CB9911F2C0EBEB965984C3CF84404573ED873495D753289AB20EF3A2B204F22C2AD883F41FE166F60D
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:]..@..;.......&..p.........../D.|.........{...cl..KN......TS;...p....."...gW.....~...~....oF~;....L.c.Jc..k_....P....u*....E.~.Y.......0....\.{Y....-h.a.<j..'s.@c..'..s0f6.....:+mn.........,..e.n.@I...X........y4.Eh.....*].}..I..JP..q..m.....:.....Iu..._.Y...!.V..k{..b).M.8T...b....~\\.S(..CY..AJv.".k..r...f.b#..o%..]K....@3Yu........&BW......3(T....v...D=,o.j.........lU6.c..cA7~..XLw}VB.....B.J.5......P.+......2...x.A.C,.:.`.l....c@n.N.#.....U..g..9.2..%Z.t...h..R....L..n...f(y....}.ii....^....*(P(...O+...?].......k.....)....v3t..u......`...M...G.I..VZ"..>.VS...BR|.\2:..@J.tQ^.p.2.ZM.G....k..lc.|....l..x.Y.....k.A\..p...H...N...0IE..S..%Y...h...c.......P9...:.LL.'.}w.... [...F%..<..=......R...b./...K....g_].....kd..V....}5.....$mP`....n......;~.E..m,...M...]........]d.r.J...g.....r.J..U...k.dy.eL7..~j.......vo.M..._...Nqtf.3...Y...+}....}.A..2UO......J....a....un.+.....p5.".,.W/.*..f.]y.=.9m.gX%..P...n.......9u.!~..d....'4..c..E.2.6

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\b160c05d-00aa-411d-8673-8b4473a458a7

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe
                                                                                                                                                              File Type:LZMA compressed data, non-streamed, size 3492792
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1016624
                                                                                                                                                              Entropy (8bit):7.9998155782029325
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:24576:Ax5T0Ot1w/18RKx5ZuYImOR2mhCredLN1roAs:Ax5T0c1auZFs2fo/
                                                                                                                                                              MD5:0EBE85588F7B3D99342DC5C186459986
                                                                                                                                                              SHA1:2B592C3FC933D0A2B08763BF542116DB4ED23ABB
                                                                                                                                                              SHA-256:6059FBF812A80DF225BF92078BE75706A5134997D03A1A7CECBF833667114ACE
                                                                                                                                                              SHA-512:6CAC6D631067AD538B5DFC83D3D57AE24555A40C7621D011B8152609B7B06B77FE251B53C96AD9DF276C7F153AB1F0152AD4EB83D7BDFDF217234B7F1823F37B
                                                                                                                                                              Malicious:true
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:]..@..K5......&..p.........../D.|..b..6>..p.}#......G...)p{` ..i=`...k.<....G..7.p..C..K.N.......A..$.....G.....hK2...{...C..{!(.V.x...^.]1.|g.@.:,......@...../....}...#.>...........B.}m..+.r[L..\.....-..d..........,^D.z.'..O@.).^..n.R..V.+...Pf.....7...h.%..TP.......u?.Z.T.}.X..tP..FW{..'....*@M...6..t.!..T...*..Iu.....S.`tx.m..........+.....@.tD...."......EK='.[k...H...x..rr[V..../L...'...$u...s(..O...G..o.@..*.!.-..V..!..K.~..0.K:F.k.NG.5..6G...t...m6.......|..'...\.....=A1..}.]T..W#..d#C^..........9...+fo.j..3.1.....W.Gb....2..k.k`.4.M..D...5...@b.Q..(`....C.u.....(....<......C.^.Nd.....G....X.{_..7^.............<....g..@S....>.."f..t.....}0E.[g....\>..c.&..K.......d.})|....2..].....2..9...I.N8....:.j...[.@dh.n..q.....sS%...'..l.k0h..Vg.f...$...j..g@........RC..;.^.z..W..`..T.O.*6......I?...f.S.8.KL...#...V.U.._...b....^|..5T|..%Y..............I..[...`...8%).[ .r..._!.V,{....suo.P....h...'O..b..E...`eX..CJ..e:C;v...^..|.J..0

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\bug_report.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe
                                                                                                                                                              File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):4903360
                                                                                                                                                              Entropy (8bit):6.522876423141521
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:49152:DMLOHWldqr5oquLxYTOf27AlAFn/vyYBnYvrlu8Mx6Nfsmr0DkTyY+JR8UyQ9UsU:JaY7AElYs8u4RnZQzHUI6/NyG
                                                                                                                                                              MD5:B269C45CA54AF5B57A5B2115D9CDB8D5
                                                                                                                                                              SHA1:67D886792DF5B3F718D5AF2D77A3AA0532CAE1C9
                                                                                                                                                              SHA-256:D9367C5E474BCA83CB06F583F2FB42EF2517D769CC82722201A0902C0B90A32A
                                                                                                                                                              SHA-512:2DF04CD928F2E9C871C5CCDA5F033F784CC32385A94A4EA1D8A204F9DC335331FC65459387F9C24295155E0EA39FFDE4A38965653968048D45DBAB76E7F06106
                                                                                                                                                              Malicious:true
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$........H..T)..T)..T)..[..)..R.$.X)..R...G)..]..])..R...#)..R...F)..[..D)..]QJ.V)...\..N)..\...)..\..U)..T)..Y)...\..|)..[..p)..[..s)..T)..6+..>...6(..>...U)..>.&.U)..T)N.V)..>...U)..RichT)..........PE..d....hf.........."....&..2..4.................@..............................K.......K...`...........................................@.......@.,.....K.......H.HO..H.J.x)... K..f....:.......................:.(...p.:.@............02..............................text...,.2.......2................. ..`.rdata..v....02......"2.............@..@.data....|...0A.......A.............@....pdata..HO....H..P....G.............@..@_RDATA........K......6J.............@..@.rsrc.........K......8J.............@..@.reloc...f... K..h...@J.............@..B................................................................................................................................

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\c21d9a86-afda-4a33-9ad7-d657cb6d993a

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe
                                                                                                                                                              File Type:LZMA compressed data, non-streamed, size 8027576
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):2418383
                                                                                                                                                              Entropy (8bit):7.999923832493421
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:49152:lVsDQXk8HUhSzZfavOHWt+6Iy1Qy5oSVeI8JvpGSRyRKaSLd:lSDZ8S6fJQ+6Iy1C+novphqKnd
                                                                                                                                                              MD5:3165CBD962F7486B3CE552D63B01CEF1
                                                                                                                                                              SHA1:28993BDECE531892ED3D5ADE8462979DCD876C6B
                                                                                                                                                              SHA-256:B278327757AE13A21EFFA24658DFCE94F15D01759D1D799A5831F81488C97E80
                                                                                                                                                              SHA-512:0F857F56AB438181ADA7071F35A26A5E15B360DC8D84760EFC6840FECD2F55A322CA6F609066A519EC5E031DDEB8B925D61C6BFA85C777C9F67F5DEED5006D22
                                                                                                                                                              Malicious:true
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:]..@..}z......&..p.........../D.|....o.e.F<w.,...vY.Ta.....NE..1E...V..Z..m9..^../:Y!....y....eg..;..XR{.Y.d.r.F.[>W.K......T P..~..A.P...9o..g.u.{H.,.....7.a..4..X..s.t.3..~a.jX..E...Q....L&z..@..V<D.i..&...(7.......4.i....ow...)u...Y..{k8...m}........)..R......q...@..2..M.....4..J..B...2.aF,.A..f3.^..*..m.iD.3.....t.xk.|......j.^.... .4..U.~..S`>.........*cSo...h.2....&.#.hy.....]..;b5.v..Qxj.L5#..s.....c'.......~.I.3.&... ..}.L]p!5.k8.X..0.E...E.r.]....t.9....;."eVr.E..y...R=!Y.......q..Ij.V....H..lQ&..p.......w.P. .....q?Y.....$....p......K..(O3y..GQm...z.k.(.d...E...d.C..%..Esr....T...X.zd.1.]..e./..z..T..jf.E.dD.....=.Pl...E..N.....'Sq..j..1l..{..R,.-..@...d..0y..,w."...n.0j.f..M.(.w...F...q....?k........'..60..........^...)o....;`@....a._.....ztH.p..G........4D.....$[C.u....I........*_~!MA..D.v.ef...$.K..o9.Y....i.D/............T..;.a..i......v ...7o~.. .%....q8..L..Lq.....^;d.....$.Q...R.JR4.......C..y/..)...Y.gw(.uY.6.$.H.....

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\c42c22c9-fabf-4e67-8f42-1d89e7da9849

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe
                                                                                                                                                              File Type:LZMA compressed data, non-streamed, size 4903360
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1453130
                                                                                                                                                              Entropy (8bit):7.999888270987114
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:24576:Z/F928AhKDf7AAzQ7B4Oe7zVFJCRNrpyBY5EeWNR9SmJzRzqYWmz2:Z/FvOKTEL787zVFJWJ2eGLJzR29my
                                                                                                                                                              MD5:2B831D4AD771C930657893B7B08A54B1
                                                                                                                                                              SHA1:61A2BE66E05000833D84D4A52F030488D44807C1
                                                                                                                                                              SHA-256:F3E869540ADB0039EDBB954EC9523F019F189DE2D72BC1782BE43B9122D956A6
                                                                                                                                                              SHA-512:53675B00AEEDC5B014FBF3FE0C4FE7FA175342B6DF0144D60BE49EF3063C723DB1867481B8497D33EAA388CE71DC3724A680163E4639AB6A56402D468A2E040F
                                                                                                                                                              Malicious:true
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:]..@...J......&..p.........../D.|..y..:.}.._..G...5mA..aQ..c5t ..+........w.uRl.,E.u9....r....dV...l.....>h.Et....T...9..D......m.V.k_.J........m........#\,,.sI.w...h}.......aJ..VFAS;.R.g.k...&*...SU.....:..9.We~Q...5..9..c#..T*......xa.h.M..cG...y.f..u..G.c.NFd.Z.N6.x.3.)}.<f....*.]..^....Pk..R...|../..xP.@.z'.z.....{i1E.p..(.41...yCj3......S.I......9..1.....E..e..../.. ..S.,............%^........"..?..Kf.6...S*.w.X..~.g..M4}...R. .|..@._....v......ty.I.......l..V4D....b+.:.d..~... ......%.|......`S~1[.l.A5W..s.....a..{...b...qy..p.nR.@...,..l.mr.u.A.^.A.. ..1..`......5...'7/....? ..Q./.J4.40..I.....*.....Sz.M...vv....S.Z.....)K.(.....&...n..kL5...-.[Qr....|....|G...&.v.........*n.&/.R.<.).b.{.o.T?..-...ds..z..#f....).....F..0..p"Ce.....}....\GX...bg31...Ow.y.w...p...)vBZ...`...^.%..d.b.&..r.DZY..u..u)(.LgT...vvJv.\./.#.|.X...........9.a._I..(...?.J..(..I.".9k......c..{..n*.......L..$N...h).|.O.. 7.&..Xt.4..G.0.\l.....b....N..._......M.....1'$...

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\dump_process.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe
                                                                                                                                                              File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):3492792
                                                                                                                                                              Entropy (8bit):6.523436707758999
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:49152:uGI2edLDbg8CcP11BLLJS+wlOwE2PdBZaZu9TpHxHcQ66OYwV8lArtYtPtRaJg16:uB2grL3wdTjoQFO9A5Xo
                                                                                                                                                              MD5:FCA231A72F159864EF730897768FE097
                                                                                                                                                              SHA1:2C29BCA3BC8F8FC5E86D35FD2CB91C0176CA309D
                                                                                                                                                              SHA-256:9CADB56DC6BDEF59526A6ACA8423FBDA0000124BF15228CD536BB178EEEE812A
                                                                                                                                                              SHA-512:FB4F1BDB2A40E02B10E2D8A290F9BEE19D4CCBCA33C0B9A056A0FB0536035361B853614DD1807461429B1AAFFAC034F26FA4E35EC01C04AD2D7423CC90A0D47F
                                                                                                                                                              Malicious:true
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.......5...q..q..q.....z...........m..wy'.r..wy.c.....x..wy.e..wy....x.I.s.....p..q..v..'..r.....h..q......y.....y.p...y%.p..q.M.s...y.p..Richq..................PE..d.....hf.........."....&." ..........8.........@..............................6.......6...`...........................................+.......+......@4..Y....2.....H"5.p)....5..U....&.......................&.(.....".@............@ .@.....+.@....................text...L! ......" ................. ..`.rdata.......@ ......& .............@..@.data... .....+..$....+.............@....pdata........2.......1.............@..@.didat..P.... 4......n3.............@..._RDATA.......04......p3.............@..@.rsrc....Y...@4..Z...r3.............@..@.reloc...U....5..V....4.............@..B................................................................................................

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\e1423531-f6b5-40bf-a17c-6bfd64d490eb

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe
                                                                                                                                                              File Type:LZMA compressed data, non-streamed, size 1318093
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):142471
                                                                                                                                                              Entropy (8bit):7.998722464044207
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:3072:itQzZklkaqeea9Ps7yE9rOwXvIhnL8HDIwcm+luKPZCng/g+:g+ZzkdL8H80+IKPmIg+
                                                                                                                                                              MD5:F7C56E13197BA540613B79E98FEC70DE
                                                                                                                                                              SHA1:C5D13CB9A000D0A93AF13943CB6AED6DB1B539BF
                                                                                                                                                              SHA-256:4B4B1A585FE679A3DD39225CA42E4B7FCFE5354C630157DDFE384A5BE1F5F57B
                                                                                                                                                              SHA-512:6EBBDBB5C1502A8A66836D70E4BE479370C633A72EB753D409981E51390C3913FFF87BDA1F9C188E8981C2F69989FA9456F678CF4371219170F0DD623533D1C4
                                                                                                                                                              Malicious:true
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:]..@................f......{3....&.7d..>$....`K...H.......4...^.a.)....0C:.6..n.f.c...j...$Px...........X.PMf$5.B....O..DN....[.d..s..s..M..:B..(.N..L.?7=~Rg.[...N!."..8......1uW.#....;u<Q..MC..Kl.#.9!U.3N..N...^....Gp..a.@....-.m..Q...c.6.....]..vK..I..(.<..s.1h.r..)y.]!J9%...*/.(]X...%."....Y.,.J.......Z..T,....u1.&......n..&.!E$Dn<..;."....@..90H$Jk4..{i%.@^...q;.%.t!......Md..fJp) m.0..>3......hs...Y.4..<...Q8.$.@.n...u..N..X..ia.f..o.."....b<...^X...z.U;..[..[....A.`.W.0.X..l...v.GfM.9..y..q... $.....4E..Xd..[l.>..R...z../KjC*d..9J...!.O..U.^.l..].S).zLS.[90....O."0...kX[$V!...b{...1&.*@a{....|.Bg.....d0K.KGS.....r.h.]m.9..}.>Y.Ha..Sh.\.UgmX.......Hm.!8.?..k..r)..z.M........bc0:...N9?Qf.w78.....j.C y...;...V8.8..'....HE.Ur..A.,.4.....k.:'Vm.M.J.`..V....*.`.U#...\.8.G.`:......7...P."~.T....|...n......qsm.|..a....L......M580...............e...c1.9.8B.i<..@..~...5..&......kl@..<%8./H..R.),.\.G....0...G....NQ.~O....T.s.p...w.....KjX,

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe
                                                                                                                                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8027576
                                                                                                                                                              Entropy (8bit):6.455870084278652
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:98304:Q8/LrPXdY6YRv8coX6f6pnpnaoi+Lu7nxTIng3t1uw5:Q8/LrPtY6Yt8qypnaoi+Lu7nxTIg9n5
                                                                                                                                                              MD5:251369428A0E2D87308E7A9FAA387270
                                                                                                                                                              SHA1:89556991DBDE37BD48CED113209BF451F7E4E74C
                                                                                                                                                              SHA-256:2445F8A0B75BEB1A77428C2D605189876222FB9D53E3B187F7B7FE8ABE3386C0
                                                                                                                                                              SHA-512:B720C02C0A359C10163FFBE8D00B456DBDBD26AE4C59098FB454CC3AB2ED4E9D710114ECA3818CBBCA201CF8366897D8BAC213E9B0A5A677CD4453B7BF7EFE5C
                                                                                                                                                              Malicious:true
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$.......................+../....(c......(.....(.....(.....+....+.....b......b................2..f...:....................+......+.........|...(......(......(a.............(......Rich............PE..d....hf.........."....&..T...%................@.............................p{.......{...`..........................................\l......]l.......y......Pv.,U..HTz.p)....z.......a.......................a.(..../Y.@.............U.x...HYl......................text.....T.......T................. ..`.rdata..$.....U.......T.............@..@.data...`.....l.......l.............@....pdata..,U...Pv..V...nu.............@..@.didat..p.....y.......x.............@..._RDATA........y.......x.............@..@.rsrc.........y.......x.............@..@.reloc........z.......y.............@..B........................................................................

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus_mod.dll

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe
                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):15288
                                                                                                                                                              Entropy (8bit):6.950937398079422
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:wOYgUAozIYiifnPeAM+o/8E9VF0NyabdoLN:+L8Yii+AMxkEOK
                                                                                                                                                              MD5:F37B83A39F1C7B6A87D0C4B41091CD87
                                                                                                                                                              SHA1:E660152EF530D105975E9BAB5858C0AEB4360701
                                                                                                                                                              SHA-256:DBEFC0C1A7785FE08AE05046F72095ACF3F3BFC348D370C99E4AC05B09C7EF46
                                                                                                                                                              SHA-512:3EC739C9FEB5C9379F045C3DCC02258FB41CE8A4731FBAD44AC16EA1CCDB8BA23602371CB60DCA9EC17115FEC8C5A3AD7B78C14069DC564D181E862B8B7D961D
                                                                                                                                                              Malicious:true
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................................*........Rich..................PE..L.....hf...........!...&..................... ...............................P............@E........................ !..\....#..<....0..............H...p)...@..(.... ............................................... .. ............................text...U........................... ..`.rdata....... ......................@..@.rsrc........0......................@..@.reloc..(....@......................@..B........................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus_ui.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe
                                                                                                                                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):12243384
                                                                                                                                                              Entropy (8bit):6.579558539578861
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:196608:REzSIoqUp+rqPDQE9J9CGZDsALgiL9vnrqNAQC:qzSIojQE9fCywifLZrqNAQC
                                                                                                                                                              MD5:A8AC4E9FC79EF367D788F434D8E04D45
                                                                                                                                                              SHA1:827F9A298FC35D7A63BB6550A5AAADE7207FDD84
                                                                                                                                                              SHA-256:4D26A67D9FB882BA9DDB9A8F90CFC0A1F17C5F526ABB83671F6B958F1BC3CD05
                                                                                                                                                              SHA-512:0EE5405C95DBDCF82811866211E48D147837480E86CB5E724C285E382D7999164C15E5D60F3824A9D4979C301A781FBDA0895E25DB7169B5EB81CF4A95547B29
                                                                                                                                                              Malicious:true
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$.........) OzGsOzGsOzGs..DrRzGs..Br.zGsI..sFzGsI.Cr[zGsI.Br?zGsI.DrYzGs..Cr.zGs[.Cr.zGs[.Br.zGsF..sMzGs..CrNzGsOzGsHzGs..BrLzGs..DrMzGs..Cr_zGs..FrzzGsOzFs.yGs%.Nr.zGs%.GrNzGs%..sNzGsOz.sMzGs%.ErNzGsRichOzGs........PE..d.....hf.........."....&.....a......D.........@....................................u.....`......................................... ........................p......H...p)..................................."..(.......@...............`............................text............................. ..`.rdata..n-%.......%................@..@.data...._4.........................@....pdata.......p......................@..@_RDATA.............................@..@.rsrc..............................@..@.reloc.............................@..B........................................................................................................................

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\product-def.xml

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe
                                                                                                                                                              File Type:XML 1.0 document, ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1318093
                                                                                                                                                              Entropy (8bit):5.392833517738244
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6144:5aoorSmXIqrauc6nrs6cwSkxNRdCJB9Crg5bMdrDWT1JyJIWp:5aoorS8cH6ZSkxNRdwB9sgb6HW7yJj
                                                                                                                                                              MD5:A61782BF711E98C41336C861994A5A65
                                                                                                                                                              SHA1:306964C8A142B3A6E0E826CCA4DB1FD948AA9C81
                                                                                                                                                              SHA-256:26032AE10582074D1B38F8AD95372CFC56CE273D7A2766B2A0DDEABB1E90BF0F
                                                                                                                                                              SHA-512:428CF6A6D5F5D56EF94BC48D8975398155F6B4A378AD29BF49A28C5D779E894BBAA9F406A46CBE45252A3CA8A1F0AF97AD20F1AAA437C66FFE44534B6F00390C
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:<?xml version="1.0" ?>.<product name="avg-av">..<product-defs>...<config>....<install-folder name="Antivirus"/>....<program-data-folder name="Antivirus"/>....<registry-key name="Antivirus"/>....<full-name name="AVG Antivirus"/>....<languages>.....<lang>en-us</lang>.....<lang>cs-cz</lang>.....<lang>da-dk</lang>.....<lang>de-de</lang>.....<lang>es-es</lang>.....<lang>fi-fi</lang>.....<lang>fr-fr</lang>.....<lang>hu-hu</lang>.....<lang>id-id</lang>.....<lang>it-it</lang>.....<lang>ja-jp</lang>.....<lang>ko-kr</lang>.....<lang>ms-my</lang>.....<lang>nb-no</lang>.....<lang>nl-nl</lang>.....<lang>pl-pl</lang>.....<lang>pt-br</lang>.....<lang>pt-pt</lang>.....<lang>ru-ru</lang>.....<lang>sk-sk</lang>.....<lang>sr-sp</lang>.....<lang>sv-se</lang>.....<lang>tr-tr</lang>.....<lang>zh-cn</lang>.....<lang>zh-tw</lang>....</languages>...</config>...<vars>....<var name="%V_PRODUCT_PREFIX%">.....<desc lang="en-us">avg</desc>....</var>....<var name="%V_AV_SVC_MODULE%">.....<desc lang="en-us">AVGSvc.ex

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\product-info.xml

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe
                                                                                                                                                              File Type:XML 1.0 document, ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):9649
                                                                                                                                                              Entropy (8bit):5.276039758494122
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:192:UOMG3s/wDmND+zBiFTWoQsUzYoHLV1xUQ28bX8ecFXOBmURzfHWpjs2:UjjwmN8Y9Y1vbMeeuB/W5P
                                                                                                                                                              MD5:1CD82588F7C425083E7C2DF8D3A635DA
                                                                                                                                                              SHA1:4C075D43B104D3BAD2802E134844D64CAF12998F
                                                                                                                                                              SHA-256:275E2B5FDA8C7924DAC945914CA156E4B5A6D7C76947D7299A7B907D798DE199
                                                                                                                                                              SHA-512:F4E142F52A584324083F411B02E9189C5462C40C9A13D16808FD0ADBE4CFA36EA01DFCACFBA5B4E935CCF490FCA5D4BDF0B0A5D11B2B5EDDD51E5325F26FF5E4
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:<?xml version="1.0" ?>.<product-info xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="product-info.xsd">..<name>avg-av</name>..<version>24.6.9241.1898</version>..<build-time>1718902903</build-time>..<setup-files>...<file>....<conditions>.....<os platform="x86"/>....</conditions>....<name>icarus.exe</name>....<src-id>69c9de9f0cc9cc846d44e8b9a42de17d93f4cde9ffcf7a10d1dff69c4cef0c1f</src-id>....<sha-256>807a5c7427f19f75f3721e775cce423aa31bd045b9d14bcb47f77613fe877a52</sha-256>....<timestamp>1718902876</timestamp>....<size>7133632</size>...</file>...<file>....<conditions>.....<os platform="x64"/>....</conditions>....<name>icarus.exe</name>....<src-id>cfab5808bd7503ee1aff23b54d5a98a557524fa453762afa10b90e4b7ca6af95</src-id>....<sha-256>2445f8a0b75beb1a77428c2d605189876222fb9d53e3b187f7b7fe8abe3386c0</sha-256>....<timestamp>1718902877</timestamp>....<size>8027576</size>...</file>...<file>....<conditions>.....<os platform="arm64"/>....</conditions>....<name

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\setupui.cont

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe
                                                                                                                                                              File Type:XZ compressed data, checksum CRC32
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):390836
                                                                                                                                                              Entropy (8bit):7.99951433163968
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:6144:4w9cqum3uw3JWjgdFLPD4kE+TSUT7vyeW7fx+QNNsynAdWjqggVim0sM84vcYkAo:4PC3dwgdFYktmUXMoryQWjpgVimxMDvu
                                                                                                                                                              MD5:8F4BC5B548488BE6E6FB1F25CA839B65
                                                                                                                                                              SHA1:E1F5831F3DDDECEB7D75413A64A0EE19077D1A78
                                                                                                                                                              SHA-256:9FCCF24557F7691F06726FA651A35B48BDBAC4556CB63188CA7C8030C0426934
                                                                                                                                                              SHA-512:7416A9B9D55DDAFB16B5FFE7393E3D9D736A02CB0D57EE795103067304615D2796405D00A89782B83EDC7A70722676FC571581AD58FFEF9978635672441DA92D
                                                                                                                                                              Malicious:true
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:.7zXZ...i".6..!.....F.;...2.e].0...?..Lm.K%. .6.X.....L.@#........EG.I.....}0.B..r}...&....c...B.+..).y>.....e.g.....H..`.O4.z=5..../1....n[f.k.S}.W.Gk...o.......-......C...._.FVc.......Uv$.<.Y...#.....3:^.O..(&00....q....99+...].M.u#s..HO.z59.I.]...a...%k..I.vd"..-1..n.Y".h.vi..L=..5]..=..<!..d.....D.....A.<....'h......5..;V.........UI.{$..U)..u.....W3.e.,!o&p'.2(..?.k...x..aB-T..6..1.q9.z..?...g...Mb HT|......3.....!ikY..I..8..{.>....:..i0'.l,...(...b.`.-./.:d..~l).l.^..@.....45.Y....._4...v.(.-..M..gu.#Q .1_Z...>v..Q.,.#.mG.....V...?.5-.M.AIb.6s...d..#.mA.4.....tySS.`o....._^.Y..)..Y....RX.u...Jz.d7S.l..P.H.EF...B..)...@.._...Ms#......._..r6.8q..g..........?'...@^K.B5..w...s....8.J....B........j.( .w..h_..n........._..&'G..8.%W.....v-.:.m.e"H@..6.....*..oM......."..ckp..Ma.!2..pTw...q.B.9../...cy..Zb..=.U...\,.d.2`.a..a..2b&2.%J.<w-V.d.O..7...5.i.......uH...I..]T^..1...,...<2.tTa..}.i...cJ=[.nD.... .@..i.0+.........Y...[..Ej.w.......L.[.;..

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\ecoo.edat

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe
                                                                                                                                                              File Type:ASCII text, with no line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):21
                                                                                                                                                              Entropy (8bit):3.422577995321604
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:1HRcMK:5RU
                                                                                                                                                              MD5:3F44A3C655AC2A5C3AB32849ECB95672
                                                                                                                                                              SHA1:93211445DCF90BB3200ABE3902C2A10FE2BAA8E4
                                                                                                                                                              SHA-256:51516A61A1E25124173DEF4EF68A6B8BABEDC28CA143F9EEE3E729EBDC1EF31F
                                                                                                                                                              SHA-512:D3F95262CF3E910DD707DFEEF8D2E9DB44DB76B2A13092D238D0145C822D87A529CA58CCBB24995DFCF6DAD1FFC8CED6D50948BB550760CD03049598C6943BC0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:mmm_irs_ppi_902_451_o

                                                                                                                                                              C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\icarus-info.xml

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe
                                                                                                                                                              File Type:XML 1.0 document, ASCII text
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1962
                                                                                                                                                              Entropy (8bit):5.405969172026559
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:cEYpSVVb4sM9FTzkcRcAIAxuX1FVRd2lEkzM:0MVV1M9FTzk4JuXHVD2FzM
                                                                                                                                                              MD5:3EEDF9552884C85810B0C522BFC94900
                                                                                                                                                              SHA1:57090D1B958718A61A154579120BA9CD0110B754
                                                                                                                                                              SHA-256:16AC5C9FA9649ECC6BCDBBF8D597D152D8A0EF513B71E4134B9CD9029FB4C93A
                                                                                                                                                              SHA-512:4F82C68458CF86BE7AB538482BE31E9472142DEA5CC6C9241785719184E93B90E53C9912FAAF2532DA58087CCCA2ACB0BCD0615F3B67F20AEE06D41CCD9AC528
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:<?xml version="1.0" encoding="utf-8"?>.<icarus-info xmlns:xs="http://www.w3.org/2001/XMLSchema-instance">..<file-mapping-sfx>...<handle>284</handle>...<size>1627112</size>..</file-mapping-sfx>..<file-list>...<file>....<alias>sfx-info.xml</alias>....<sha-256>9ab20794b3a2aba9c3b1c4679fe0ff4b19e03928533b53314f28c41142349f97</sha-256>....<offset>1607238</offset>....<size>717</size>....<timestamp>1719324643</timestamp>....<flags>0</flags>...</file>...<file>....<alias>avg-av/edition.edat</alias>....<sha-256>e629fa6598d732768f7c726b4b621285f9c3b85303900aa912017db7617d8bdb</sha-256>....<offset>1608032</offset>....<size>2</size>....<timestamp>1719324643</timestamp>....<flags>0</flags>...</file>...<file>....<alias>avg-av/config.def.edat</alias>....<sha-256>67dd20872ec1a4e1e12f66c3c5ed6d9e6543ed2857739086f3b0492700ba6c40</sha-256>....<offset>1608114</offset>....<size>8251</size>....<timestamp>1719324494</timestamp>....<flags>1</flags>...</file>..</file-list>..<sfx-dir>C:\Windows\Temp\asw.481015ae

                                                                                                                                                              C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exe
                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1627112
                                                                                                                                                              Entropy (8bit):6.776553747493877
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:49152:v3Qbb9IOp7KuPooooELwPVlEmI4Ele47h:Yb2Op7d5VlEmj
                                                                                                                                                              MD5:89799311702BD341AA9B7DAEE903B5C2
                                                                                                                                                              SHA1:B32E451773202BBAA8106D6F6A72CAD8C6CCFE3A
                                                                                                                                                              SHA-256:FDD5DB7B0BA463D31FC12A0478854E393E02102164F6B19CEBB7CD3AC496E2D3
                                                                                                                                                              SHA-512:2BFFF85071AA51AB8E11207750845E4D4C89ACD7E14EF095130AA701F2E8E9334B4E454C74471FE9564E0B2494A5E38C94555DC1A4331898A56DB44BFCFBAEA4
                                                                                                                                                              Malicious:true
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.......'.}.c..,c..,c..,...-l..,...-...,e>.,a..,e>.-w..,e>.-y..,e>.-...,...-z..,...-f..,j.,a..,5..-b..,c..,e..,...-b..,...-v..,c..,..,.>.-..,.>.-b..,.>.,b..,c..,`..,.>.-b..,Richc..,................PE..L...B.hf...............&.V.......... I.......p....@..................................7....@............................................@r..........p...x)...........#......................@$......8|..@............p...............................text....U.......V.................. ..`.rdata...=...p...>...Z..............@..@.data...............................@....didat..T............@..............@....rsrc...@r.......t...B..............@..@.reloc..............................@..B................................................................................................................................................................................................

                                                                                                                                                              C:\Windows\Temp\asw.481015ae89dc80a3\ecoo.edat

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exe
                                                                                                                                                              File Type:ASCII text, with no line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):21
                                                                                                                                                              Entropy (8bit):3.422577995321604
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:1HRcMK:5RU
                                                                                                                                                              MD5:3F44A3C655AC2A5C3AB32849ECB95672
                                                                                                                                                              SHA1:93211445DCF90BB3200ABE3902C2A10FE2BAA8E4
                                                                                                                                                              SHA-256:51516A61A1E25124173DEF4EF68A6B8BABEDC28CA143F9EEE3E729EBDC1EF31F
                                                                                                                                                              SHA-512:D3F95262CF3E910DD707DFEEF8D2E9DB44DB76B2A13092D238D0145C822D87A529CA58CCBB24995DFCF6DAD1FFC8CED6D50948BB550760CD03049598C6943BC0
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:mmm_irs_ppi_902_451_o

                                                                                                                                                              C:\Windows\appcompat\Programs\Amcache.hve

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                              File Type:MS Windows registry file, NT/2000 or above
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1835008
                                                                                                                                                              Entropy (8bit):4.463167184373658
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:6144:rIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uN2dwBCswSbn:sXD94+WlLZMM6YFHg+n
                                                                                                                                                              MD5:D895EAC0CDF82514A498EC244DD2FED0
                                                                                                                                                              SHA1:603380CB8A65B74BEB5EF45A041DE52926445D78
                                                                                                                                                              SHA-256:5E7D808F9B3CC1B66547EE2969CDC7BEC863AC1FDA7C72AE472C27ADA7DB23CB
                                                                                                                                                              SHA-512:BAAEC734C27F82F3E23A20EC7F6A9AB44BA6B3E94FA81431BE75C2E93AC7C6AC7E9393E5D9C2FD1F0CB8ABAB8284FAB38C0A8F7EFBD3E05F86815172957DB0F4
                                                                                                                                                              Malicious:false
                                                                                                                                                              Reputation:unknown
                                                                                                                                                              Preview:regf7...7....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...+J...............................................................................................................................................................................................................................................................................................................................................^...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              Static File Info

                                                                                                                                                              General

                                                                                                                                                              File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Entropy (8bit):7.692003571525227
                                                                                                                                                              TrID:
                                                                                                                                                              • Win32 Executable (generic) a (10002005/4) 98.45%
                                                                                                                                                              • Inno Setup installer (109748/4) 1.08%
                                                                                                                                                              • Win32 EXE PECompact compressed (generic) (41571/9) 0.41%
                                                                                                                                                              • Win16/32 Executable Delphi generic (2074/23) 0.02%
                                                                                                                                                              • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                              File name:SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe
                                                                                                                                                              File size:2'576'200 bytes
                                                                                                                                                              MD5:3cb0739401d24b6bc0c65e337e15c104
                                                                                                                                                              SHA1:aefca0e1d01e9ffecd8cc2a0c9dc495d6f5fe9d8
                                                                                                                                                              SHA256:48053935a1b62d13f2a1301d42a3be930bb4718e8476c32b5050512209fdb3bb
                                                                                                                                                              SHA512:09614a891e2a8bdc00f4ecf717490a5fe3c1f6607d732eddd1c6a31a10a8759d9b17d5d80f2db40c05b502f9c12d5d674321d17dfa22cc7cb6077ae70cd46251
                                                                                                                                                              SSDEEP:49152:vqe3f6oq1tmZkXd/METL9lzPIu0JrIIpJ6ez0kTkkaQ:SSio4MZkXd/XHP50JrIIyeYWkkaQ
                                                                                                                                                              TLSH:18C5E13BB258653EC4AA0B3185738360597B7F65A81A8C2F47F07C0DEF764611E3BA16
                                                                                                                                                              File Content Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

                                                                                                                                                              File Icon

                                                                                                                                                              Icon Hash:3371f0d4d4d47117

                                                                                                                                                              Static PE Info

                                                                                                                                                              General

                                                                                                                                                              Entrypoint:0x4b5eec
                                                                                                                                                              Entrypoint Section:.itext
                                                                                                                                                              Digitally signed:true
                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                              Subsystem:windows gui
                                                                                                                                                              Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
                                                                                                                                                              DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                                                                                                                              Time Stamp:0x5FB0F96E [Sun Nov 15 09:48:30 2020 UTC]
                                                                                                                                                              TLS Callbacks:
                                                                                                                                                              CLR (.Net) Version:
                                                                                                                                                              OS Version Major:6
                                                                                                                                                              OS Version Minor:1
                                                                                                                                                              File Version Major:6
                                                                                                                                                              File Version Minor:1
                                                                                                                                                              Subsystem Version Major:6
                                                                                                                                                              Subsystem Version Minor:1
                                                                                                                                                              Import Hash:5a594319a0d69dbc452e748bcf05892e

                                                                                                                                                              Authenticode Signature

                                                                                                                                                              Signature Valid:true
                                                                                                                                                              Signature Issuer:CN=Certum Code Signing 2021 CA, O=Asseco Data Systems S.A., C=PL
                                                                                                                                                              Signature Validation Error:The operation completed successfully
                                                                                                                                                              Error Number:0
                                                                                                                                                              Not Before, Not After
                                                                                                                                                              • 24/11/2023 17:20:30 23/11/2026 17:20:29
                                                                                                                                                              Subject Chain
                                                                                                                                                              • E=wxhere@hotmail.com, CN=Xing Wang, O=Xing Wang, L=Shanghai, C=CN
                                                                                                                                                              Version:3
                                                                                                                                                              Thumbprint MD5:7A742F7A11DA60D6B28ED77287CB1B98
                                                                                                                                                              Thumbprint SHA-1:D1CDF37E4A61C7F13F8DF0BFA4A4A26BAB7AE33B
                                                                                                                                                              Thumbprint SHA-256:FD3D28462CA469508569FB0D4DE9C956D168989F192D0558BF9A5FB288DAA54C
                                                                                                                                                              Serial:48B06EDB116D54BE21D51656D91CF246

                                                                                                                                                              Entrypoint Preview

                                                                                                                                                              Instruction
                                                                                                                                                              push ebp
                                                                                                                                                              mov ebp, esp
                                                                                                                                                              add esp, FFFFFFA4h
                                                                                                                                                              push ebx
                                                                                                                                                              push esi
                                                                                                                                                              push edi
                                                                                                                                                              xor eax, eax
                                                                                                                                                              mov dword ptr [ebp-3Ch], eax
                                                                                                                                                              mov dword ptr [ebp-40h], eax
                                                                                                                                                              mov dword ptr [ebp-5Ch], eax
                                                                                                                                                              mov dword ptr [ebp-30h], eax
                                                                                                                                                              mov dword ptr [ebp-38h], eax
                                                                                                                                                              mov dword ptr [ebp-34h], eax
                                                                                                                                                              mov dword ptr [ebp-2Ch], eax
                                                                                                                                                              mov dword ptr [ebp-28h], eax
                                                                                                                                                              mov dword ptr [ebp-14h], eax
                                                                                                                                                              mov eax, 004B10F0h
                                                                                                                                                              call 00007FD6287AA105h
                                                                                                                                                              xor eax, eax
                                                                                                                                                              push ebp
                                                                                                                                                              push 004B65E2h
                                                                                                                                                              push dword ptr fs:[eax]
                                                                                                                                                              mov dword ptr fs:[eax], esp
                                                                                                                                                              xor edx, edx
                                                                                                                                                              push ebp
                                                                                                                                                              push 004B659Eh
                                                                                                                                                              push dword ptr fs:[edx]
                                                                                                                                                              mov dword ptr fs:[edx], esp
                                                                                                                                                              mov eax, dword ptr [004BE634h]
                                                                                                                                                              call 00007FD62884C82Fh
                                                                                                                                                              call 00007FD62884C382h
                                                                                                                                                              lea edx, dword ptr [ebp-14h]
                                                                                                                                                              xor eax, eax
                                                                                                                                                              call 00007FD6287BFB78h
                                                                                                                                                              mov edx, dword ptr [ebp-14h]
                                                                                                                                                              mov eax, 004C1D84h
                                                                                                                                                              call 00007FD6287A4CF7h
                                                                                                                                                              push 00000002h
                                                                                                                                                              push 00000000h
                                                                                                                                                              push 00000001h
                                                                                                                                                              mov ecx, dword ptr [004C1D84h]
                                                                                                                                                              mov dl, 01h
                                                                                                                                                              mov eax, dword ptr [004237A4h]
                                                                                                                                                              call 00007FD6287C0BDFh
                                                                                                                                                              mov dword ptr [004C1D88h], eax
                                                                                                                                                              xor edx, edx
                                                                                                                                                              push ebp
                                                                                                                                                              push 004B654Ah
                                                                                                                                                              push dword ptr fs:[edx]
                                                                                                                                                              mov dword ptr fs:[edx], esp
                                                                                                                                                              call 00007FD62884C8B7h
                                                                                                                                                              mov dword ptr [004C1D90h], eax
                                                                                                                                                              mov eax, dword ptr [004C1D90h]
                                                                                                                                                              cmp dword ptr [eax+0Ch], 01h
                                                                                                                                                              jne 00007FD628852E9Ah
                                                                                                                                                              mov eax, dword ptr [004C1D90h]
                                                                                                                                                              mov edx, 00000028h
                                                                                                                                                              call 00007FD6287C14D4h
                                                                                                                                                              mov edx, dword ptr [004C1D90h]

                                                                                                                                                              Data Directories

                                                                                                                                                              NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_EXPORT0xc40000x9a.edata
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_IMPORT0xc20000xf36.idata
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_RESOURCE0xc70000x1c358.rsrc
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_SECURITY0x2727b80x2790
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_TLS0xc60000x18.rdata
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_IAT0xc22e40x244.idata
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0xc30000x1a4.didata
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                              Sections

                                                                                                                                                              NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                              .text0x10000xb361c0xb3800ad6e46e3a3acdb533eb6a077f6d065afFalse0.3448639341051532data6.356058204328091IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                              .itext0xb50000x16880x1800d40fc822339d01f2abcc5493ac101c94False0.544921875data5.972750055221053IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                              .data0xb70000x37a40x38004c195d5591f6d61265df08a3733de3a2False0.36097935267857145data5.044400562007734IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                              .bss0xbb0000x6de80x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                              .idata0xc20000xf360x1000a73d686f1e8b9bb06ec767721135e397False0.3681640625data4.8987046479600425IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                              .didata0xc30000x1a40x20041b8ce23dd243d14beebc71771885c89False0.345703125data2.7563628682496506IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                              .edata0xc40000x9a0x20037c1a5c63717831863e018c0f51dabb7False0.2578125data1.8722228665884297IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                              .tls0xc50000x180x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                              .rdata0xc60000x5d0x2008f2f090acd9622c88a6a852e72f94e96False0.189453125data1.3838943752217987IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                              .rsrc0xc70000x1c3580x1c4002535f9c4c989641b0dda90b5f3cc5e48False0.5281733960176991data5.499677719140543IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                                                              Resources

                                                                                                                                                              NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                              RT_ICON0xc75580x3173PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.9552097322063354
                                                                                                                                                              RT_ICON0xca6cc0x10828Device independent bitmap graphic, 128 x 256 x 32, image size 67584EnglishUnited States0.486498876138649
                                                                                                                                                              RT_ICON0xdaef40x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9216EnglishUnited States0.6074688796680497
                                                                                                                                                              RT_ICON0xdd49c0x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4096EnglishUnited States0.6775328330206379
                                                                                                                                                              RT_ICON0xde5440x988Device independent bitmap graphic, 24 x 48 x 32, image size 2304EnglishUnited States0.7344262295081967
                                                                                                                                                              RT_ICON0xdeecc0x468Device independent bitmap graphic, 16 x 32 x 32, image size 1024EnglishUnited States0.8182624113475178
                                                                                                                                                              RT_ICON0xdf3340x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4096EnglishUnited States0.6775328330206379
                                                                                                                                                              RT_STRING0xe03dc0x360data0.34375
                                                                                                                                                              RT_STRING0xe073c0x260data0.3256578947368421
                                                                                                                                                              RT_STRING0xe099c0x45cdata0.4068100358422939
                                                                                                                                                              RT_STRING0xe0df80x40cdata0.3754826254826255
                                                                                                                                                              RT_STRING0xe12040x2d4data0.39226519337016574
                                                                                                                                                              RT_STRING0xe14d80xb8data0.6467391304347826
                                                                                                                                                              RT_STRING0xe15900x9cdata0.6410256410256411
                                                                                                                                                              RT_STRING0xe162c0x374data0.4230769230769231
                                                                                                                                                              RT_STRING0xe19a00x398data0.3358695652173913
                                                                                                                                                              RT_STRING0xe1d380x368data0.3795871559633027
                                                                                                                                                              RT_STRING0xe20a00x2a4data0.4275147928994083
                                                                                                                                                              RT_RCDATA0xe23440x10data1.5
                                                                                                                                                              RT_RCDATA0xe23540x2c4data0.6384180790960452
                                                                                                                                                              RT_RCDATA0xe26180x2cdata1.2045454545454546
                                                                                                                                                              RT_GROUP_ICON0xe26440x68dataEnglishUnited States0.7115384615384616
                                                                                                                                                              RT_VERSION0xe26ac0x584dataEnglishUnited States0.26274787535410765
                                                                                                                                                              RT_MANIFEST0xe2c300x726XML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.4005464480874317

                                                                                                                                                              Imports

                                                                                                                                                              DLLImport
                                                                                                                                                              kernel32.dllGetACP, GetExitCodeProcess, LocalFree, CloseHandle, SizeofResource, VirtualProtect, VirtualFree, GetFullPathNameW, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVersion, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetSystemInfo, GetCommandLineW, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
                                                                                                                                                              comctl32.dllInitCommonControls
                                                                                                                                                              version.dllGetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
                                                                                                                                                              user32.dllCreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
                                                                                                                                                              oleaut32.dllSysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
                                                                                                                                                              netapi32.dllNetWkstaGetInfo, NetApiBufferFree
                                                                                                                                                              advapi32.dllRegQueryValueExW, AdjustTokenPrivileges, LookupPrivilegeValueW, RegCloseKey, OpenProcessToken, RegOpenKeyExW

                                                                                                                                                              Exports

                                                                                                                                                              NameOrdinalAddress
                                                                                                                                                              TMethodImplementationIntercept30x454060
                                                                                                                                                              __dbk_fcall_wrapper20x40d0a0
                                                                                                                                                              dbkFCallWrapperAddr10x4be63c

                                                                                                                                                              Possible Origin

                                                                                                                                                              Language of compilation systemCountry where language is spokenMap
                                                                                                                                                              EnglishUnited States

                                                                                                                                                              Network Behavior

                                                                                                                                                              Suricata IDS Alerts

                                                                                                                                                              TimestampProtocolSIDSignatureSource PortDest PortSource IPDest IP
                                                                                                                                                              2024-07-18T21:39:09.215258+0200TCP2053283ET ADWARE_PUP Win32/OfferCore Checkin M249753443192.168.2.4143.204.205.88
                                                                                                                                                              2024-07-18T21:38:07.239150+0200TCP2053280ET ADWARE_PUP Win32/OfferCore Checkin M149734443192.168.2.413.249.12.125
                                                                                                                                                              2024-07-18T21:38:57.817749+0200TCP2053283ET ADWARE_PUP Win32/OfferCore Checkin M249748443192.168.2.413.249.12.125
                                                                                                                                                              2024-07-18T21:38:09.209567+0200TCP2053283ET ADWARE_PUP Win32/OfferCore Checkin M249735443192.168.2.413.249.12.125
                                                                                                                                                              2024-07-18T21:39:07.291314+0200TCP2053283ET ADWARE_PUP Win32/OfferCore Checkin M249750443192.168.2.4143.204.205.88

                                                                                                                                                              Network Port Distribution

                                                                                                                                                              TCP Packets

                                                                                                                                                              TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                              Jul 18, 2024 21:38:06.050843954 CEST49734443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:06.050877094 CEST4434973413.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:06.050949097 CEST49734443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:06.053826094 CEST49734443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:06.053837061 CEST4434973413.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:06.817161083 CEST4434973413.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:06.817245960 CEST49734443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:06.821508884 CEST49734443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:06.821521997 CEST4434973413.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:06.821913004 CEST4434973413.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:06.874726057 CEST49734443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:06.874766111 CEST49734443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:06.875124931 CEST4434973413.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:07.239172935 CEST4434973413.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:07.239203930 CEST4434973413.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:07.239216089 CEST4434973413.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:07.239231110 CEST4434973413.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:07.239239931 CEST4434973413.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:07.239281893 CEST49734443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:07.239299059 CEST4434973413.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:07.239315033 CEST49734443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:07.240408897 CEST4434973413.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:07.240468979 CEST49734443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:07.240540028 CEST49734443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:07.240551949 CEST4434973413.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:07.475929022 CEST49735443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:07.475979090 CEST4434973513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:07.476046085 CEST49735443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:07.476959944 CEST49735443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:07.476974964 CEST4434973513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:08.688601971 CEST4434973513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:08.688762903 CEST49735443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:08.690207005 CEST49735443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:08.690216064 CEST4434973513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:08.690576077 CEST4434973513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:08.691812992 CEST49735443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:08.691850901 CEST49735443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:08.691860914 CEST4434973513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:09.209611893 CEST4434973513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:09.210592031 CEST4434973513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:09.210684061 CEST49735443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:09.210726976 CEST49735443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:09.210750103 CEST4434973513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:09.210762978 CEST49735443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:09.210777998 CEST4434973513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:09.346863985 CEST49736443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:09.346925020 CEST4434973613.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:09.346998930 CEST49736443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:09.347302914 CEST49736443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:09.347317934 CEST4434973613.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:10.001616001 CEST49736443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:10.184175014 CEST49737443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:10.184251070 CEST4434973713.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:10.184343100 CEST49737443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:10.184670925 CEST49737443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:10.184699059 CEST4434973713.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:10.910926104 CEST4434973713.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:10.911067963 CEST49737443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:10.912456989 CEST49737443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:10.912480116 CEST4434973713.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:10.912770033 CEST4434973713.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:10.914149046 CEST49737443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:10.956528902 CEST4434973713.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:11.173248053 CEST4434973713.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:11.182677031 CEST4434973713.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:11.182734013 CEST4434973713.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:11.182763100 CEST49737443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:11.182807922 CEST4434973713.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:11.182838917 CEST49737443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:11.182864904 CEST49737443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:11.263900995 CEST4434973713.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:11.263978004 CEST4434973713.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:11.264020920 CEST49737443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:11.264044046 CEST4434973713.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:11.264064074 CEST49737443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:11.264089108 CEST49737443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:11.268790007 CEST4434973713.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:11.268846035 CEST4434973713.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:11.268893957 CEST49737443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:11.268910885 CEST4434973713.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:11.268944025 CEST49737443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:11.268974066 CEST49737443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:11.271754980 CEST4434973713.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:11.271835089 CEST49737443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:11.271856070 CEST4434973713.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:11.271898985 CEST4434973713.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:11.271909952 CEST49737443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:11.271953106 CEST4434973713.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:11.271986008 CEST49737443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:11.271986008 CEST49737443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:11.272008896 CEST4434973713.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:11.272030115 CEST4434973713.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:19.748667955 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:19.748717070 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:19.748929024 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:19.749351025 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:19.749377012 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:20.511588097 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:20.511720896 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:20.513411999 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:20.513427019 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:20.513638020 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:20.515249014 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:20.560508966 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:20.787261963 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:20.787285089 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:20.787327051 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:20.787386894 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:20.787431955 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:20.787450075 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:20.787480116 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:20.877996922 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:20.878043890 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:20.878083944 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:20.878128052 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:20.878158092 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:20.878180981 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:20.878760099 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:20.878783941 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:20.878817081 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:20.878829956 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:20.878861904 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:20.878895998 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:20.967287064 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:20.967312098 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:20.967459917 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:20.967500925 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:20.967550993 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:20.968508959 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:20.968523979 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:20.968594074 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:20.968602896 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:20.968642950 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:20.971328020 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:20.971343994 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:20.971389055 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:20.971396923 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:20.971431017 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:20.976818085 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:20.976835012 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:20.976897955 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:20.976907015 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:20.976943016 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.058439016 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.058461905 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.058670998 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.058708906 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.058758020 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.059417963 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.059432983 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.059495926 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.059505939 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.059547901 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.060380936 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.060400009 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.060455084 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.060477018 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.060513973 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.061248064 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.061264992 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.061320066 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.061328888 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.061367035 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.062947989 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.062968969 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.063014984 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.063024044 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.063060045 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.066869974 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.066890001 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.066946030 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.066968918 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.067007065 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.068423033 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.068444014 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.068505049 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.068514109 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.068553925 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.109738111 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.109762907 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.109961987 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.109994888 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.110043049 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.153062105 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.153086901 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.153156042 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.153177977 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.153227091 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.153378010 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.153459072 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.153474092 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.153533936 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.153542995 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.153578043 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.153944016 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.153956890 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.154011965 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.154021025 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.154059887 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.155477047 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.155491114 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.155544043 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.155554056 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.155592918 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.482637882 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.482671022 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.482721090 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.482748032 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.482784033 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.482799053 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.482836008 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.482940912 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.482985973 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.482995987 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.483016014 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.483076096 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.484698057 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.484767914 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.484772921 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.484772921 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.484807968 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.484838009 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.484869957 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.485018969 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.485074043 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.485094070 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.485105038 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.485152960 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.485152960 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.485177040 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.485225916 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.485234022 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.485256910 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.485277891 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.485299110 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.485419035 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.485464096 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.485477924 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.485488892 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.485527992 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.485527992 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.486232042 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.486282110 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.486412048 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.486419916 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.486498117 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.486498117 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.487720966 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.487766027 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.487792969 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.487801075 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.487837076 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.487837076 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.489980936 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.490026951 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.490055084 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.490066051 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.490087986 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.490108967 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.490487099 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.490537882 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.490566015 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.490573883 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.490600109 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.490621090 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.491461039 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.491514921 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.491539001 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.491547108 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.491589069 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.492538929 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.492585897 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.492599010 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.492599010 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.492619991 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.492655993 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.492682934 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.493882895 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.493931055 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.493956089 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.493964911 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.493979931 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.493999958 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.497543097 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.497598886 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.497622967 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.497639894 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.497673035 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.497684956 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.498047113 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.498092890 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.498111010 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.498120070 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.498147011 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.498157024 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.499066114 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.499125004 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.499167919 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.499176979 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.499207020 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.499214888 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.499644041 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.499691010 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.499716997 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.499725103 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.499757051 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.499777079 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.500463009 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.500524044 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.500526905 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.500549078 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.500581026 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.500591993 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.501468897 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.501518011 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.501564980 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.501574039 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.501616955 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.501616955 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.502490044 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.502537966 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.502568960 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.502577066 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.502598047 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.502607107 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.502938032 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.502981901 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.503000021 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.503009081 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.503024101 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.503067970 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.503669024 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.503719091 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.503731966 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.503741980 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.503809929 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.503834009 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.504468918 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.504535913 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.504558086 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.504566908 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.504581928 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.504601955 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.505372047 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.505412102 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.505435944 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.505444050 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.505462885 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.505475044 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.505779982 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.505827904 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.505845070 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.505853891 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.505867958 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.505889893 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.506637096 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.506684065 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.506704092 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.506711960 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.506725073 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.506753922 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.507543087 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.507586956 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.507611036 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.507617950 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.507638931 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.507649899 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.508028030 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.508074999 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.508099079 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.508107901 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.508121014 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.508141994 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.524135113 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.524180889 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.524209023 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.524216890 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.524239063 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.524251938 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.524884939 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.524930000 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.524952888 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.524961948 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.524982929 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.525002003 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.525671005 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.525715113 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.525734901 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.525742054 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.525764942 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.525777102 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.526108980 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.526153088 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.526180029 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.526186943 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.526210070 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.526221991 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.533318996 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.533368111 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.533409119 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.533423901 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.533433914 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.533456087 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.536648989 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.536693096 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.536735058 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.536745071 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.536757946 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.536775112 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.537714958 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.537758112 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.537781954 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.537790060 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.537808895 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.537827015 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.579596043 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.579648972 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.579705000 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.579744101 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.579761982 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.580154896 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.625876904 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.625955105 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.626014948 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.626034975 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.626054049 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.626442909 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.626491070 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.626524925 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.626534939 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.626547098 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.626576900 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.626904964 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.626948118 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.626980066 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.626987934 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.627008915 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.627286911 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.627335072 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.627357960 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.627367020 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.627393961 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.627465963 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.628334999 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.628376961 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.628415108 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.628436089 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.628449917 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.630095005 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.630374908 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.630422115 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.630444050 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.630460024 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.630479097 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.631264925 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.631330013 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.631346941 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.631373882 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.631408930 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.631433964 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.672925949 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.672993898 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.673111916 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.673145056 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.673166037 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.673192024 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.717807055 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.717839003 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.717895031 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.717932940 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.717941046 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.717972994 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.717998028 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.717998028 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.718409061 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.718430996 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.718457937 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.718473911 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.718489885 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.719067097 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.719091892 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.719125032 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.719141006 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.719156981 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.719733000 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.719752073 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.719784021 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.719798088 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.719813108 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.724081993 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.724104881 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.724189043 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.724217892 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.724236012 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.724915028 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.724934101 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.724977016 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.724992037 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.767206907 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.769228935 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.769260883 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.769315958 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.769337893 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.769355059 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.769371033 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.810549974 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.810573101 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.810631037 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.810674906 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.810691118 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.810770035 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.810923100 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.810945034 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.810985088 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.810992956 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.811021090 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.811034918 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.811321974 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.811345100 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.811377048 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.811386108 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.811413050 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.811422110 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.811714888 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.811738014 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.811781883 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.811789036 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.811809063 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.811830997 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.812145948 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.812166929 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.812201977 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.812210083 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.812228918 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.812248945 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.815062046 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.815080881 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.815138102 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.815170050 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.815198898 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.815215111 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.816072941 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.816092014 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.816138029 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.816148996 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.816162109 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.818470955 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.862106085 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.862133026 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.862174988 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.862190008 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.862216949 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.862230062 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.903990030 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.904026031 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.904069901 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.904089928 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.904117107 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.904134989 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.904350042 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.904371977 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.904418945 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.904426098 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.904445887 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.904463053 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.904891968 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.904921055 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.904953957 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.904962063 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.904989004 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.905004978 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.905284882 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.905317068 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.905344963 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.905352116 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.905375957 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.905392885 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.905685902 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.905706882 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.905744076 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.905751944 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.905781984 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.905791044 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.908340931 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.908363104 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.908411026 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.908418894 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.908447027 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.908457994 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.908646107 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.908669949 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.908696890 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.908704996 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.908788919 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.908859968 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.956319094 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.956345081 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.956422091 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.956438065 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.956465006 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.956486940 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.999547005 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.999572992 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.999650002 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.999658108 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.999681950 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.999701023 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.999927044 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.999952078 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:21.999991894 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:21.999998093 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.000021935 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.000039101 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.000349045 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.000369072 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.000400066 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.000406027 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.000425100 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.000442982 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.000775099 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.000797987 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.000838995 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.000845909 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.000869989 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.000883102 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.001174927 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.001200914 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.001230001 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.001236916 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.001264095 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.001283884 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.001590014 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.001614094 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.001651049 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.001657963 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.001682043 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.001693964 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.002000093 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.002044916 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.002063036 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.002068996 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.002094984 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.002108097 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.003518105 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.051342010 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.051367044 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.051451921 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.051484108 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.054431915 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.092793941 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.092830896 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.093010902 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.093031883 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.093208075 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.093261003 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.093282938 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.093312979 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.093321085 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.093348026 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.093362093 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.093676090 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.093697071 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.093730927 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.093744040 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.093765020 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.093781948 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.094099045 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.094120026 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.094150066 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.094157934 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.094181061 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.094197989 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.094516039 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.094537020 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.094564915 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.094574928 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.094594002 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.094608068 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.095017910 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.095040083 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.095067024 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.095077038 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.095102072 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.095118046 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.095580101 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.095602989 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.095637083 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.095650911 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.095666885 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.095690012 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.098190069 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.150876045 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.150911093 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.151047945 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.151076078 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.151119947 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.185677052 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.185714960 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.185750008 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.185760975 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.185785055 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.185798883 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.185992956 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.186064005 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.186090946 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.186098099 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.186121941 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.186136007 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.188127995 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.188163042 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.188194036 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.188200951 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.188210011 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.188275099 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.188467026 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.188513994 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.188530922 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.188536882 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.188559055 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.188576937 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.188910961 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.188946009 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.188967943 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.188975096 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.188994884 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.189030886 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.189270973 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.189311028 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.189347982 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.189352989 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.189377069 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.189394951 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.189552069 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.189584970 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.189609051 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.189615011 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.189634085 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.189647913 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.246350050 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.246391058 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.246438026 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.246465921 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.246479034 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.249667883 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.278669119 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.278702021 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.278779030 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.278809071 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.278824091 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.278852940 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.279126883 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.279156923 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.279190063 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.279205084 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.279215097 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.281244993 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.281785011 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.281817913 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.281898022 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.281898022 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.281913042 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.282030106 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.282121897 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.282146931 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.282182932 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.282191992 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.282208920 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.282221079 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.282576084 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.282602072 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.282629013 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.282636881 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.282655954 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.282670975 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.283044100 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.283075094 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.283097029 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.283103943 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.283123970 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.283137083 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.283447981 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.283471107 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.283499956 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.283509970 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.283528090 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.283543110 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.289880991 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.361951113 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.361977100 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.362023115 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.362054110 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.362067938 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.362087011 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.406316996 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.406358004 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.406404018 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.406431913 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.406450033 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.406471968 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.406809092 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.406835079 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.406866074 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.406878948 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.406892061 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.406918049 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.407934904 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.407968044 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.407994032 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.408010006 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.408025026 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.408044100 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.409178019 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.409198046 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.409226894 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.409244061 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.409255028 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.409276962 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.409648895 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.409668922 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.409697056 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.409706116 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.409737110 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.409751892 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.410329103 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.410352945 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.410377979 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.410388947 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.410412073 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.410430908 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.410903931 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.410928965 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.410959005 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.410970926 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.410996914 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.411015987 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.499049902 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.499083996 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.499279022 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.499308109 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.499640942 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.502537012 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.502558947 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.502593994 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.502615929 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.502631903 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.502650023 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.502803087 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.502824068 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.502856970 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.502866030 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.502891064 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.502962112 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.503334045 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.503355980 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.503385067 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.503391981 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.503412008 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.503417969 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.503427982 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.503443956 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.503467083 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.503473043 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.503498077 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.503504038 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.503525019 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.503535986 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.503928900 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.503952026 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.503977060 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.503985882 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.504014015 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.504036903 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.504252911 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.504272938 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.504302025 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.504309893 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.504331112 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.504348993 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.504656076 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.504678011 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.504729033 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.504738092 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.504765034 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.504776955 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.593513966 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.593543053 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.593700886 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.593735933 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.593776941 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.595556021 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.595572948 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.595637083 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.595655918 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.595696926 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.595823050 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.595838070 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.595881939 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.595889091 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.595921040 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.596473932 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.596498966 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.596529961 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.596539021 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.596560955 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.596573114 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.596832037 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.596847057 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.596879959 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.596888065 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.596908092 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.596925974 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.597167969 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.597184896 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.597218037 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.597224951 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.597255945 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.597328901 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.597606897 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.597626925 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.597657919 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.597665071 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.597687006 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.597702980 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.597939014 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.597955942 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.597986937 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.597995043 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.598021030 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.598033905 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.602341890 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.686450005 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.686507940 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.686580896 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.686615944 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.686630011 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.686661005 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.688451052 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.688513994 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.688535929 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.688544035 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.688571930 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.688585997 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.688798904 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.688846111 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.688870907 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.688879013 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.688901901 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.688913107 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.689172983 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.689215899 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.689254045 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.689260006 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.689274073 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.689296961 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.689683914 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.689723969 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.689754963 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.689762115 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.689779043 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.689801931 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.690182924 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.690222979 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.690253019 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.690260887 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.690279961 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.690299034 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.690768003 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.690808058 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.690841913 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.690850019 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.690875053 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.690884113 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.691082954 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.691139936 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.691174984 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.691180944 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.691196918 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.691220045 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.779649973 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.779671907 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.779877901 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.779911041 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.779953957 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.781271935 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.781291962 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.781347036 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.781362057 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.781403065 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.781569004 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.781585932 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.781630993 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.781640053 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.781672955 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.782180071 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.782193899 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.782412052 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.782417059 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.782429934 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.782461882 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.782470942 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.782481909 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.782510996 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.782520056 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.782752991 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.782766104 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.782816887 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.782825947 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.782857895 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.783245087 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.783262968 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.783303022 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.783309937 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.783339977 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.784198046 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.784215927 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.784272909 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.784284115 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.784385920 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.876286983 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.876352072 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.876369953 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.876396894 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.876414061 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.876449108 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.876920938 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.876964092 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.876988888 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.876996040 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.877022028 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.877042055 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.877295971 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.877340078 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.877357960 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.877366066 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.877386093 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.877401114 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.877433062 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.877480030 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.877511978 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.877517939 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.877542973 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.877561092 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.878137112 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.878194094 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.878199100 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.878227949 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.878252029 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.878264904 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.878376007 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.878420115 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.878434896 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.878443003 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.878469944 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.878483057 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.878932953 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.879020929 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.879039049 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.879048109 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.879065037 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.879098892 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.879194021 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.879237890 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.879256964 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.879264116 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.879290104 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.879300117 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.967875957 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.967933893 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.967967987 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.968014956 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.968029976 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.968053102 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.968146086 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.968188047 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.968199968 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.968209982 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.968230963 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.968245029 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.968612909 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.968656063 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.968708038 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.968719006 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.968739986 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.968769073 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.968911886 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.968956947 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.968976021 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.968982935 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.969026089 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.969049931 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.969163895 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.969202995 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.969218969 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.969228029 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.969244957 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.969269037 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.969661951 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.969702959 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.969733953 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.969743013 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.969764948 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.969770908 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.970000982 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.970041037 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.970077038 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.970084906 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.970098019 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.970118046 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.971764088 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.971806049 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.971827030 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.971837044 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:22.971864939 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:22.971884966 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.061024904 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.061052084 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.061106920 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.061137915 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.061177969 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.061254978 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.061270952 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.061307907 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.061316013 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.061352968 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.061356068 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.061367989 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.061394930 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.061423063 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.061430931 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.061443090 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.061465025 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.061877966 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.061892986 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.061935902 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.061943054 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.061980963 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.062578917 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.062596083 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.062638044 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.062647104 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.062669039 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.062685966 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.062892914 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.062913895 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.062949896 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.062957048 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.062980890 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.063003063 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.063114882 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.063133001 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.063157082 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.063164949 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.063184023 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.063199043 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.067218065 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.067245960 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.067276955 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.067298889 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.067323923 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.067334890 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.154098034 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.154126883 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.154218912 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.154253006 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.154290915 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.154592037 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.154607058 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.154655933 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.154664040 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.154700994 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.155045986 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.155088902 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.155267000 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.155273914 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.155327082 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.155548096 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.155563116 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.155618906 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.155625105 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.155667067 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.155771971 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.155786991 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.155832052 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.155842066 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.155877113 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.156102896 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.156119108 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.156183004 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.156193018 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.156229973 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.156841040 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.156863928 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.156903982 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.156918049 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.156936884 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.156951904 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.160448074 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.160469055 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.160533905 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.160541058 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.160582066 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.247034073 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.247062922 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.247216940 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.247256041 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.247301102 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.247390032 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.247412920 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.247545958 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.247555971 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.247610092 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.247796059 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.247821093 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.247870922 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.247879028 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.247912884 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.248334885 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.248357058 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.248405933 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.248411894 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.248447895 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.248492002 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.248502016 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.248511076 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.248543978 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.248972893 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.248994112 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.249036074 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.249044895 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.249083042 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.249416113 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.249437094 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.249466896 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.249475002 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.249489069 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.249505997 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.252955914 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.252983093 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.253096104 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.253117085 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.253158092 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.343569040 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.343631029 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.343827963 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.343873024 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.343923092 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.344564915 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.344616890 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.344644070 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.344650984 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.344675064 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.344691038 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.344880104 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.344938040 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.344957113 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.344964027 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.345002890 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.345352888 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.345401049 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.345419884 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.345427990 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.345462084 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.346201897 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.346251011 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.346256971 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.346267939 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.346295118 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.346318960 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.346338987 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.346514940 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.346555948 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.346600056 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.346611977 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.346636057 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.346642017 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.346775055 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.346820116 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.346833944 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.346843004 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.346869946 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.346884012 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.354142904 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.354216099 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.354250908 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.354279041 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.354291916 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.354311943 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.439393997 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.439430952 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.439510107 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.439537048 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.439575911 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.439970970 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.439991951 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.440042973 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.440051079 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.440083981 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.440325975 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.440345049 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.440390110 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.440397978 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.440448999 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.440602064 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.440623045 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.440671921 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.440680027 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.440735102 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.440907001 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.440924883 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.440968037 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.440973997 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.441003084 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.441463947 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.441483021 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.441529989 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.441534996 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.441567898 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.441845894 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.441863060 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.441910982 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.441916943 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.441948891 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.447223902 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.447251081 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.447319984 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.447345018 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.447386026 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.533339024 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.533360958 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.533442020 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.533478975 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.533524036 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.533706903 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.533725023 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.533775091 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.533785105 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.533822060 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.533970118 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.533986092 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.534035921 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.534044027 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.534081936 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.534588099 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.534604073 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.534648895 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.534657001 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.534693003 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.535047054 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.535062075 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.535109043 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.535116911 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.535147905 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.535392046 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.535406113 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.535451889 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.535459042 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.535490036 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.535525084 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.535537004 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.535562038 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.535569906 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.535593987 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.535609961 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.544609070 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.544636011 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.544724941 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.544761896 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.544806957 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.629483938 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.629513025 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.629569054 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.629605055 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.629616022 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.629637957 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.629663944 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.629709959 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.629734993 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.629832029 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.629852057 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.629883051 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.629892111 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.629904032 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.630330086 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.630351067 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.630419016 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.630430937 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.630703926 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.630721092 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.630757093 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.630764961 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.630776882 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.631072044 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.631086111 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.631130934 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.631140947 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.637857914 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.637875080 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.638005972 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.638024092 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.663256884 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.721347094 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.721371889 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.721416950 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.721425056 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.721472025 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.721491098 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.721534967 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.722063065 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.722078085 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.722121954 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.722130060 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.722141027 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.722179890 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.722198009 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.722238064 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.722245932 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.722270012 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.722594023 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.722608089 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.722641945 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.722649097 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.722661018 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.722759008 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.722776890 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.722805977 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.722814083 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.722826004 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.723144054 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.723159075 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.723191977 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.723200083 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.723212004 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.725153923 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.725225925 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.731070995 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.731086969 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.731158018 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.731169939 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.731190920 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.782948971 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.813891888 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.813922882 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.813985109 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.814011097 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.814063072 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.814266920 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.814294100 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.814332008 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.814340115 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.814371109 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.814378977 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.814594030 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.814610958 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.814651012 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.814659119 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.814707994 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.814999104 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.815016985 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.815066099 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.815073967 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.815098047 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.815120935 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.815411091 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.815435886 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.815577030 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.815586090 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.815645933 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.815888882 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.815907955 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.815974951 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.815982103 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.816019058 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.816246986 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.816265106 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.816313028 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.816320896 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.816359043 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.823858976 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.823874950 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.823931932 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.823941946 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.823991060 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.906807899 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.906835079 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.906900883 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.906917095 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.906959057 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.906975031 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.907043934 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.907067060 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.907135963 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.907144070 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.907180071 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.907494068 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.907515049 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.907572985 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.907581091 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.907589912 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.907624960 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.907757998 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.907774925 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.907830000 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.907836914 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.907898903 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.907994986 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.908011913 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.908057928 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.908065081 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.908094883 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.908214092 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.908658028 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.908674002 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.908727884 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.908735037 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.908777952 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.909038067 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.909054995 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.909087896 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.909095049 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.909121990 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.909137011 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.917201996 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.917220116 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.917283058 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:23.917293072 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:23.917340994 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.000952005 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.001035929 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.001108885 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.001108885 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.001173019 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.001219988 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.001231909 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.001264095 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.001322031 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.001332045 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.001332045 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.001372099 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.001399040 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.001418114 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.001511097 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.001564980 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.001606941 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.001606941 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.001615047 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.001630068 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.001652002 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.001691103 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.001738071 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.001753092 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.001760960 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.001791954 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.001801014 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.001863956 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.001909971 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.001926899 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.001936913 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.001970053 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.001982927 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.236308098 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.236334085 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.236490011 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.236537933 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.236589909 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.236754894 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.236772060 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.236829042 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.236839056 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.236877918 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.237171888 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.237195969 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.237257957 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.237267971 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.237323999 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.238244057 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.238265038 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.238322973 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.238334894 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.238373995 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.238574982 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.238591909 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.238640070 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.238648891 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.238673925 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.238702059 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.239067078 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.239084959 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.239136934 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.239145994 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.239185095 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.239414930 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.239429951 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.239501953 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.239511967 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.239551067 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.239851952 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.239867926 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.239918947 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.239928961 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.239968061 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.240232944 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.240253925 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.240303040 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.240312099 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.240354061 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.240684986 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.240706921 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.240765095 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.240775108 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.240812063 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.241071939 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.241087914 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.241142035 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.241151094 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.241189003 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.242314100 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.242328882 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.242388010 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.242398024 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.242434978 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.242707968 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.242727041 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.242774010 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.242783070 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.242820978 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.243082047 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.243103981 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.243159056 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.243166924 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.243206978 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.243484020 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.243499994 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.243562937 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.243571043 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.243613005 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.243875027 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.243894100 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.243949890 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.243958950 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.244003057 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.244200945 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.244224072 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.244286060 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.244296074 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.244344950 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.244560957 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.244584084 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.244628906 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.244638920 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.244677067 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.244703054 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.245008945 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.245028973 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.245086908 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.245098114 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.245162964 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.281284094 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.281316996 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.281559944 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.281560898 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.281603098 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.281622887 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.281651974 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.281666040 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.281691074 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.281703949 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.281725883 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.281744003 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.281964064 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.281985044 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.282042027 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.282052040 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.282093048 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.282473087 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.282499075 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.282557011 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.282566071 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.282608032 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.282852888 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.282872915 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.282915115 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.282922983 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.282959938 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.282959938 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.283214092 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.283231020 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.283292055 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.283301115 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.283344030 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.283565998 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.283581972 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.283667088 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.283675909 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.283714056 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.290293932 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.290317059 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.290411949 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.290424109 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.290467978 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.376848936 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.376883984 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.377043009 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.377101898 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.377151966 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.377191067 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.377217054 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.377253056 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.377264023 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.377305984 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.377305984 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.377693892 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.377712965 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.377758980 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.377768040 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.377793074 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.377810001 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.378204107 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.378221035 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.378268003 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.378274918 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.378285885 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.378303051 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.378324986 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.378350019 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.378357887 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.378415108 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.378505945 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.378521919 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.378559113 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.378566980 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.378592014 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.378611088 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.379374027 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.379390955 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.379430056 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.379440069 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.379478931 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.380048037 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.382973909 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.382994890 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.383086920 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.383105040 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.383147955 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.469854116 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.469923973 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.470017910 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.470046043 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.470077038 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.470092058 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.470098972 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.470124006 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.470151901 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.470175982 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.470181942 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.470206022 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.470236063 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.470287085 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.470458984 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.470510960 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.470521927 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.470535994 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.470568895 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.470587015 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.470880032 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.470921040 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.470942974 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.470951080 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.470979929 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.470993042 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.471400976 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.471442938 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.471477032 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.471483946 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.471509933 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.471527100 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.471810102 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.471858978 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.471884012 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.471893072 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.471913099 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.471930981 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.472048044 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.472091913 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.472110987 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.472117901 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.472141981 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.472156048 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.476772070 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.476814985 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.476851940 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.476878881 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.476893902 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.476926088 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.565926075 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.565994978 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.566076994 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.566123962 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.566148043 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.566169977 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.571166992 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.571255922 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.571290970 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.571325064 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.571343899 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.571358919 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.575298071 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.575354099 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.575387001 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.575417995 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.575437069 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.575459003 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.575676918 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.575722933 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.575745106 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.575756073 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.575782061 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.575798035 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.575865030 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.575906992 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.575921059 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.575931072 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.575949907 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.575965881 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.577529907 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.577581882 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.577611923 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.577641964 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.577658892 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.577677965 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.577735901 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.577786922 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.577800989 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.577812910 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.577828884 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.577846050 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.577913046 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.577966928 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.577987909 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.578001022 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.578021049 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.578035116 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.659183979 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.659257889 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.659358025 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.659404039 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.659429073 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.659446001 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.659574986 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.659629107 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.659643888 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.659652948 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.659672022 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.659693956 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.664275885 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.664321899 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.664380074 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.664423943 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.664443970 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.664494991 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.664624929 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.664674044 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.664695024 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.664705992 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.664731979 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.664755106 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.664997101 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.665052891 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.665070057 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.665090084 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.665107012 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.665128946 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.665232897 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.665275097 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.665294886 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.665303946 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.665318012 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.665350914 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.665606022 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.665647030 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.665664911 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.665674925 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.665704012 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.665724993 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.670300961 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.775772095 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.775819063 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.775928020 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.775986910 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.776041031 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.776539087 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.776582956 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.776634932 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.776648045 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.776659966 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.776686907 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.776726961 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.776767969 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.776796103 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.776803017 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.776849985 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.776881933 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.776922941 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.776931047 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.776935101 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.776962996 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.776995897 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.777019024 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.777196884 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.777237892 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.777261972 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.777271032 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.777283907 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.777307987 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.777451992 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.777494907 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.777517080 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.777523994 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.777548075 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.777566910 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.777637959 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.777677059 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.777692080 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.777699947 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.777755976 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.778362989 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.778415918 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.778418064 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.778441906 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.778444052 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.778477907 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.778501987 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.870069981 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.870119095 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.870152950 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.870187044 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.870213985 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.870239019 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.870286942 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.870330095 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.870352030 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.870358944 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.870382071 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.870399952 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.870570898 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.870616913 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.870635986 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.870642900 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.870666981 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.870686054 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.871093988 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.871136904 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.871165991 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.871172905 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.871198893 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.871227980 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.871644020 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.871682882 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.871710062 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.871721983 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.871738911 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.871759892 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.871864080 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.871906996 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.871922970 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.871934891 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.871954918 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.871972084 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.872675896 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.872721910 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.872745991 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.872757912 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.872771025 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.872788906 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.872919083 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.872961044 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.872982979 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.872991085 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.873012066 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.873028994 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.962477922 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.962522984 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.962554932 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.962589979 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.962604046 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.962630987 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.963148117 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.963190079 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.963213921 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.963223934 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.963249922 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.963267088 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.963543892 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.963583946 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.963606119 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.963613987 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.963624954 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.963648081 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.963985920 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.964026928 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.964044094 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.964055061 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.964086056 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.964097023 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.964351892 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.964394093 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.964416981 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.964425087 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.964438915 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.964457035 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.964745045 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.964783907 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.964809895 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.964817047 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.964828014 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.964917898 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.965364933 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.965415001 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.965432882 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.965441942 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.965470076 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.965478897 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.965615034 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.965657949 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.965683937 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.965691090 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:24.965713024 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:24.965723038 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.058448076 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.058520079 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.058548927 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.058604956 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.058619976 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.058646917 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.058659077 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.058695078 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.058718920 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.058742046 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.058743954 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.058769941 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.058801889 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.058821917 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.058971882 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.059015036 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.059031010 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.059040070 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.059053898 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.059096098 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.059763908 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.059812069 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.059851885 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.059861898 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.059873104 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.059901953 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.059971094 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.060014009 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.060025930 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.060036898 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.060059071 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.060077906 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.061167955 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.061212063 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.061234951 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.061244011 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.061270952 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.061289072 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.061556101 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.061600924 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.061629057 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.061636925 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.061664104 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.061672926 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.062064886 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.062112093 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.062136889 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.062144995 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.062164068 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.062181950 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.496078968 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.496114969 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.496160984 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.496237993 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.496287107 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.496305943 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.496323109 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.496341944 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.496351004 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.496376991 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.496377945 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.496392965 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.496412039 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.496433020 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.496454954 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.496603012 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.496643066 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.496701002 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.496701002 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.496711016 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.496751070 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.496933937 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.496989965 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.497005939 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.497015953 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.497044086 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.497055054 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.497209072 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.497257948 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.497277975 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.497287035 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.497304916 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.497323036 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.497819901 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.497862101 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.497889996 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.497898102 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.497981071 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.497981071 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.498003006 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.498048067 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.498068094 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.498076916 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.498193026 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.498235941 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.498235941 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.498243093 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.498251915 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.498281002 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.498312950 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.498337984 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.499161959 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.499202013 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.499229908 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.499239922 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.499252081 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.499277115 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.499341965 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.499385118 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.499403000 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.499411106 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.499425888 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.499453068 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.499485016 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.499538898 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.499557018 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.499566078 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.499592066 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.499609947 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.500113010 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.500154018 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.500185013 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.500191927 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.500215054 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.500236988 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.500315905 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.500360966 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.500380993 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.500387907 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.500411034 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.500421047 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.501159906 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.501208067 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.501243114 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.501250029 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.501281023 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.501301050 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.501384974 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.501386881 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.501439095 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.501458883 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.501466036 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.501492977 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.501504898 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.501533985 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.501591921 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.501606941 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.501614094 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.501653910 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.501971006 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.502223015 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.502273083 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.502294064 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.502300978 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.502326965 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.502343893 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.502367973 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.502420902 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.502434969 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.502444029 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.502474070 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.502489090 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.503002882 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.503051043 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.503071070 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.503078938 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.503099918 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.503145933 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.503437996 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.503484964 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.503509998 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.503518105 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.503540993 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.503555059 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.503623962 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.503673077 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.503693104 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.503700972 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.503716946 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.503735065 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.503776073 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.503823042 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.503834963 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.503846884 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.503878117 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.503890038 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.504316092 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.504357100 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.504381895 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.504390001 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.504432917 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.504580975 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.504651070 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.504699945 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.504722118 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.504729986 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.504756927 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.504767895 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.504880905 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.504925013 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.504940033 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.504949093 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.504977942 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.504990101 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.505017042 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.505063057 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.505076885 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.505085945 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.505115032 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.505126953 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.505707026 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.505754948 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.505779982 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.505788088 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.505810022 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.505824089 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.505932093 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.505974054 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.505996943 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.506004095 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.506028891 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.506040096 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.506100893 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.506143093 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.506165981 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.506174088 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.506197929 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.506208897 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.506736040 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.506786108 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.506808043 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.506815910 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.506841898 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.506851912 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.507141113 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.507194042 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.507220030 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.507227898 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.507251024 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.507266045 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.507323980 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.507375956 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.507390976 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.507400036 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.507441998 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.574481010 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.574497938 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.574568033 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.574601889 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.574645996 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.574908018 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.574922085 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.574975967 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.574985981 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.575022936 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.575588942 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.575602055 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.575654030 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.575663090 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.575700045 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.576169968 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.576184034 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.576236010 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.576245070 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.576282978 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.576664925 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.576679945 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.576730967 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.576740026 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.576777935 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.577155113 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.577169895 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.577220917 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.577229977 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.577265978 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.577523947 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.577538967 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.577588081 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.577596903 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.577635050 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.577927113 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.577941895 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.577984095 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.577991962 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.578016043 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.578027010 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.674987078 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.675005913 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.675085068 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.675127983 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.675173998 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.675731897 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.675746918 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.675796986 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.675806999 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.675846100 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.676084995 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.676100969 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.676140070 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.676148891 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.676175117 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.676186085 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.676867962 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.676881075 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.676944017 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.676953077 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.676990986 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.677284956 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.677299976 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.677355051 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.677364111 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.677403927 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.677665949 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.677687883 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.677742004 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.677751064 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.677787066 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.679713964 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.679730892 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.679790974 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.679799080 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.679836988 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.679841042 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.679850101 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.679867029 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.679887056 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.679914951 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.679920912 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.679965019 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.697892904 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.773907900 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.773947001 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.774068117 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.774117947 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.774154902 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.774173975 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.774173975 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.774188995 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.774219990 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.774271965 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.774455070 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.774471045 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.774507999 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.774516106 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.774575949 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.774756908 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.774775982 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.774806023 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.774806023 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.774816036 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.774844885 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.774864912 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.775104046 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.775120974 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.775176048 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.775185108 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.775237083 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.775686979 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.775702953 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.775757074 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.775764942 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.775808096 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.776190996 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.776206970 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.776262999 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.776271105 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.776313066 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.776463985 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.776478052 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.776531935 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.776540995 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.776583910 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.861114025 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.861131907 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.861211061 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.861254930 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.861290932 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.861299992 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.861310959 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.861324072 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.861341000 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.861373901 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.861584902 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.861598969 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.861646891 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.861669064 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.861680984 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.861712933 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.866595984 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.866614103 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.866672039 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.866682053 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.866705894 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.866729975 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.867185116 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.867208958 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.867263079 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.867270947 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.867309093 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.867712975 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.867731094 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.867784023 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.867791891 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.867827892 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.868156910 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.868175983 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.868230104 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.868237019 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.868273020 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.868590117 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.868606091 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.868650913 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.868658066 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.868699074 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.954169989 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.954188108 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.954307079 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.954335928 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.954381943 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.954534054 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.954550028 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.954595089 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.954603910 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.954631090 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.954678059 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.954879999 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.954896927 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.954936981 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.954945087 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.954967976 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.955091953 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.959897041 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.959913015 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.959979057 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.959991932 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.960032940 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.960299015 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.960314035 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.960359097 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.960366964 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.960403919 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.960591078 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.960604906 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.960653067 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.960660934 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.960681915 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.960701942 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.960715055 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.960730076 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.960773945 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.960781097 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.960829973 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.961028099 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.961044073 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.961081028 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.961088896 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:25.961110115 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.961133957 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:25.962390900 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.046794891 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.046813011 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.046892881 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.046971083 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.047013044 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.047307968 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.047322989 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.047398090 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.047406912 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.047472000 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.047472000 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.047739983 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.047754049 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.047804117 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.047811031 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.047822952 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.047856092 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.052298069 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.052321911 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.052370071 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.052377939 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.052416086 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.055264950 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.055280924 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.055325985 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.055356026 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.055408001 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.055663109 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.055677891 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.055712938 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.055720091 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.055737972 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.055758953 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.056139946 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.056154966 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.056196928 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.056204081 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.056224108 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.056245089 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.056442022 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.056457043 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.056525946 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.056534052 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.056574106 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.139763117 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.139780998 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.139858007 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.139889956 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.139938116 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.140425920 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.140443087 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.140497923 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.140508890 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.140593052 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.140742064 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.140757084 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.140800953 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.140836000 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.140882969 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.145113945 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.145129919 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.145284891 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.145297050 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.145339966 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.147725105 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.147739887 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.147805929 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.147813082 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.147850990 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.148071051 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.148086071 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.148139000 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.148144960 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.148180008 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.148444891 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.148459911 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.148500919 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.148507118 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.148541927 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.148859978 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.148874044 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.148924112 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.148930073 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.148964882 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.233598948 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.233614922 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.233694077 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.233716965 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.233760118 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.233865023 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.233880043 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.233930111 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.233937025 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.233975887 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.234260082 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.234293938 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.234453917 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.234461069 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.234499931 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.237919092 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.237934113 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.237991095 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.237998962 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.238039970 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.240211964 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.240228891 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.240278006 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.240283966 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.240323067 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.240694046 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.240710020 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.240757942 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.240763903 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.240799904 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.240989923 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.241004944 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.241051912 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.241059065 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.241096020 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.241355896 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.241372108 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.241420984 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.241426945 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.241463900 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.326131105 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.326150894 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.326240063 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.326267958 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.326316118 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.326453924 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.326493979 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.326546907 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.326555014 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.326590061 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.327140093 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.327159882 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.327209949 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.327215910 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.327253103 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.330699921 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.330715895 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.330764055 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.330771923 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.330790043 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.330802917 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.334574938 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.334592104 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.334641933 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.334647894 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.334681034 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.335020065 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.335036039 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.335196972 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.335202932 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.335244894 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.335344076 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.335361958 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.335400105 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.335407019 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.335433006 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.335448027 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.335828066 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.335844994 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.335897923 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.335903883 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.335937023 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.418946028 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.418971062 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.419064045 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.419095993 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.419111967 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.419140100 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.419325113 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.419353008 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.419384956 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.419393063 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.419418097 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.419439077 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.419892073 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.419913054 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.419956923 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.419962883 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.419996977 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.420013905 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.423840046 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.423861980 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.423940897 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.423950911 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.423994064 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.426907063 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.426928043 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.426980972 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.426991940 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.427011013 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.427037954 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.427424908 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.427447081 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.427478075 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.427488089 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.427510977 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.427526951 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.427967072 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.427987099 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.428033113 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.428041935 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.428067923 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.428087950 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.428469896 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.428499937 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.428529978 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.428538084 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.428565979 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.428580999 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.513108969 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.513143063 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.513212919 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.513225079 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.513250113 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.513263941 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.514400005 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.514422894 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.514475107 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.514482975 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.514519930 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.515455008 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.515476942 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.515515089 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.515521049 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.515547037 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.515554905 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.517735958 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.517759085 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.517797947 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.517805099 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.517832994 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.517846107 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.519869089 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.519896984 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.519942045 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.519948959 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.519958019 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.519984961 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.520437002 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.520457029 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.520494938 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.520503044 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.520524979 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.520539045 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.521034002 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.521054983 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.521091938 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.521099091 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.521122932 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.521138906 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.521563053 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.521584034 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.521622896 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.521629095 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.521651030 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.521670103 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.606996059 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.607038021 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.607229948 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.607270002 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.607326031 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.607445955 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.607469082 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.607508898 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.607517004 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.607544899 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.607558966 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.607793093 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.607814074 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.607851028 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.607857943 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.607882977 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.607899904 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.611985922 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.612016916 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.612076044 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.612085104 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.612123013 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.613992929 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.614025116 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.614068031 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.614074945 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.614101887 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.614126921 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.614901066 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.614922047 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.614979982 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.614988089 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.615024090 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.615407944 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.615437031 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.615472078 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.615478039 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.615506887 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.615516901 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.616066933 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.616089106 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.616136074 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.616142988 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.616180897 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.711163044 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.711285114 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.711340904 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.711369991 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.711385012 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.711409092 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.711838961 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.711883068 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.712017059 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.712017059 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.712043047 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.712091923 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.712826014 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.712852955 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.712908030 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.712917089 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.712958097 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.713466883 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.713495016 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.713550091 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.713557959 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.713598013 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.715985060 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.716007948 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.716063976 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.716072083 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.716111898 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.716401100 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.716417074 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.716473103 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.716480017 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.716548920 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.716893911 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.716909885 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.716962099 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.716969967 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.717024088 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.717319012 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.717345953 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.717402935 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.717417002 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.717451096 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.806094885 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.806116104 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.806199074 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.806233883 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.806276083 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.806418896 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.806440115 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.806469917 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.806476116 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.806498051 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.806510925 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.807327032 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.807343006 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.807389021 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.807395935 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.807446957 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.807794094 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.807809114 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.807857990 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.807864904 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.807898998 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.808980942 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.808995962 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.809040070 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.809046030 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.809079885 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.809127092 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.809143066 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.809168100 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.809174061 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.809195995 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.809211016 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.809325933 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.809341908 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.809372902 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.809377909 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.809396029 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.809408903 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.809540033 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.809555054 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.809602022 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.809608936 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.809639931 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.906315088 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.906338930 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.906465054 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.906522036 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.906584978 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.907064915 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.907079935 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.907134056 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.907140970 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.907176971 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.907393932 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.907408953 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.907465935 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.907475948 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.907509089 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.908976078 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.908993006 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.909049034 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.909054995 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.909090042 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.909333944 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.909349918 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.909399986 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.909406900 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.909440041 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.909621954 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.909636974 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.909679890 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.909687042 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.909723043 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.912394047 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.912420988 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.912457943 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.912463903 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.912486076 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.912502050 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.912648916 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.912666082 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.912717104 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:26.912724018 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:26.912761927 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.002065897 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.002089977 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.002156973 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.002171040 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.002207994 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.002408028 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.002425909 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.002511978 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.002541065 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.002583027 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.002763033 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.002778053 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.002818108 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.002830029 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.002868891 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.004201889 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.004218102 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.004278898 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.004285097 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.004324913 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.006683111 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.006697893 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.006757021 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.006767035 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.006804943 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.007181883 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.007198095 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.007247925 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.007255077 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.007293940 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.007524967 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.007550001 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.007603884 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.007611990 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.007649899 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.007880926 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.007900953 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.007946968 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.007955074 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.007985115 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.100155115 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.100183964 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.100308895 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.100353956 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.100409031 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.100905895 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.100929022 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.100999117 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.101011038 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.101025105 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.101047993 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.101052999 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.101064920 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.101084948 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.101115942 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.101794958 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.101810932 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.101871967 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.101887941 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.101937056 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.103132963 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.103149891 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.103194952 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.103214025 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.103230953 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.103252888 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.107590914 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.107614994 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.107697964 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.107728958 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.107779980 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.107830048 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.107847929 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.107888937 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.107898951 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.107924938 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.107939959 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.108392000 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.108407974 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.108477116 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.108495951 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.108545065 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.195739031 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.195764065 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.195887089 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.195921898 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.195960999 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.196069002 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.196085930 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.196124077 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.196134090 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.196158886 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.196172953 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.196434975 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.196455956 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.196496010 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.196508884 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.196527004 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.196540117 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.197211981 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.197235107 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.197283983 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.197297096 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.197335005 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.199707031 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.199733973 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.199789047 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.199810982 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.199836016 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.199846029 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.203144073 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.203161001 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.203213930 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.203237057 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.203274012 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.203475952 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.203491926 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.203531027 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.203540087 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.203557014 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.203569889 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.205137014 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.205154896 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.205223083 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.205246925 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.205276966 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.289212942 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.289237022 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.289360046 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.289402008 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.289443970 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.289520025 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.289537907 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.289566994 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.289576054 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.289594889 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.289611101 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.289894104 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.289907932 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.289956093 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.289967060 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.289998055 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.291079044 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.291095018 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.291143894 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.291162014 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.291194916 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.293119907 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.293142080 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.293190956 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.293206930 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.293240070 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.295949936 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.295965910 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.296008110 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.296015978 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.296051025 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.297492027 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.297508001 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.297553062 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.297559977 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.297590971 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.298075914 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.298095942 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.298134089 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.298141003 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.298170090 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.382198095 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.382225990 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.382306099 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.382363081 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.382378101 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.382399082 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.382744074 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.382760048 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.382908106 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.382915974 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.382947922 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.383408070 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.383423090 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.383477926 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.383485079 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.383518934 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.383949041 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.383964062 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.384011030 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.384017944 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.384049892 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.389322996 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.389349937 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.389398098 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.389411926 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.389444113 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.391202927 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.391221046 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.391259909 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.391271114 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.391305923 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.393449068 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.393465996 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.393526077 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.393541098 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.393574953 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.394834042 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.394850016 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.394901991 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.394912004 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.394944906 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.478964090 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.478990078 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.479187012 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.479243040 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.479288101 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.479439020 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.479454041 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.479484081 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.479495049 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.479512930 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.479531050 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.479872942 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.479890108 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.479935884 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.479950905 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.479984045 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.480287075 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.480309010 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.480355978 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.480369091 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.480401993 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.489644051 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.489659071 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.489734888 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.489754915 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.489881992 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.490035057 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.490046978 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.490103960 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.490115881 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.490149021 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.490442038 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.490459919 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.490518093 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.490530014 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.490564108 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.492062092 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.492078066 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.492129087 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.492145061 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.492180109 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.590409994 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.590425968 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.590629101 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.590663910 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.590709925 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.590842009 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.590856075 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.590903044 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.590910912 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.590948105 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.591197014 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.591212034 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.591255903 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.591264009 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.591296911 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.591959000 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.591973066 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.592027903 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.592036009 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.592072010 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.592314959 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.592329025 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.592381001 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.592389107 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.592473030 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.592689991 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.592704058 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.592752934 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.592760086 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.592792988 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.592916012 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.594521046 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.594536066 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.594585896 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.594594955 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.594630003 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.594892025 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.594906092 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.594957113 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.594964027 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.595001936 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.678606987 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.678622007 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.678853989 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.678872108 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.678926945 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.680911064 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.680926085 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.681014061 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.681020975 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.681061029 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.684807062 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.684828043 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.684904099 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.684910059 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.684948921 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.685225010 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.685240030 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.685296059 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.685305119 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.685343981 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.686517954 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.686532974 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.686599970 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.686605930 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.686642885 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.686896086 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.686909914 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.686959982 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.686966896 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.687001944 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.687304974 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.687319994 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.687374115 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.687381983 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.687429905 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.687693119 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.687707901 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.687763929 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.687771082 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.687808990 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.793282032 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.793308020 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.793453932 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.793483973 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.793493986 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.793538094 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.793556929 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.793556929 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.801409006 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.801422119 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.801496983 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.801508904 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.803332090 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.803349018 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.803400040 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.803409100 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.803440094 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.803755999 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.803769112 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.803822994 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.803832054 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.804126024 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.804147959 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.804188013 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.804198027 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.804208040 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.804577112 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.804589033 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.804635048 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.804641008 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.804682016 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.804955006 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.804971933 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.805010080 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.805016994 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.805046082 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.845304966 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.904572964 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.904597998 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.904694080 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.904711962 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.904753923 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.905590057 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.905611992 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.905672073 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.905679941 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.905718088 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.905955076 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.905970097 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.906013966 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.906021118 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.906058073 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.907650948 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.907665014 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.907716990 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.907725096 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.907762051 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.908032894 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.908052921 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.908102989 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.908111095 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.908145905 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.911581993 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.911597967 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.911670923 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.911679029 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.911715031 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.911983013 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.911998987 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.912051916 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.912059069 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.912096024 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.912338018 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.912353992 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.912404060 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.912410021 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.912446976 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.997068882 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.997092962 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.997243881 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.997263908 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.997320890 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.998922110 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.998939037 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.999003887 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:27.999011993 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:27.999061108 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.002626896 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.002641916 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.002707958 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.002717018 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.002758980 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.004584074 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.004600048 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.004677057 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.004684925 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.004726887 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.005697966 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.005770922 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.005834103 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.005841017 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.005882025 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.007028103 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.007042885 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.007110119 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.007117033 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.007165909 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.008049011 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.008064032 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.008124113 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.008131981 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.008171082 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.009778976 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.009793997 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.009862900 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.009871006 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.009912014 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.095746994 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.095774889 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.095824957 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.095850945 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.095916033 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.095916033 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.098752022 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.098767996 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.098839998 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.098850965 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.098887920 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.099370003 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.099385023 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.099421978 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.099428892 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.099451065 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.099462986 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.101464033 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.101480007 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.101536036 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.101545095 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.101579905 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.103080034 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.103096008 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.103146076 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.103153944 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.103193998 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.104312897 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.104330063 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.104377031 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.104384899 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.104428053 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.105417013 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.105432034 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.105483055 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.105490923 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.105530977 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.106128931 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.106142998 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.106184959 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.106193066 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.106224060 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.204860926 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.204880953 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.205019951 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.205051899 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.205091000 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.206362963 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.206393003 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.206535101 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.206545115 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.206587076 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.207654953 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.207670927 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.207725048 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.207735062 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.207772017 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.208890915 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.208904982 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.208956003 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.208965063 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.208997011 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.210656881 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.210671902 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.210727930 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.210736036 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.210771084 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.211731911 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.211745977 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.211793900 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.211802006 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.211837053 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.212805033 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.212819099 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.212861061 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.212869883 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.212904930 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.214551926 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.214572906 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.214617968 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.214627028 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.214660883 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.299097061 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.299118996 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.299217939 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.299248934 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.299290895 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.300884962 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.300899982 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.300940990 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.300947905 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.300970078 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.300981045 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.304378033 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.304393053 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.304451942 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.304460049 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.304497957 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.305962086 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.305975914 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.306027889 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.306035995 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.306068897 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.307177067 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.307190895 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.307223082 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.307229996 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.307251930 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.307270050 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.309010983 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.309026957 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.309079885 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.309087038 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.309120893 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.310784101 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.310801983 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.310848951 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.310857058 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.310893059 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.311908007 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.311922073 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.311960936 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.311968088 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.312006950 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.393153906 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.393176079 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.393354893 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.393398046 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.393524885 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.395621061 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.395637989 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.395719051 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.395725965 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.395780087 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.405457020 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.405474901 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.405529976 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.405536890 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.405579090 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.409600019 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.409619093 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.409689903 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.409697056 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.409734964 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.411047935 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.411065102 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.411114931 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.411122084 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.411156893 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.414971113 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.414989948 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.415041924 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.415049076 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.415083885 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.417382956 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.417406082 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.417459965 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.417469025 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.417504072 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.419852018 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.419867039 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.419928074 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.419945955 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.419979095 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.486243963 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.486264944 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.486352921 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.486371994 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.486383915 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.486417055 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.491372108 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.491388083 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.491436958 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.491444111 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.491470098 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.491482973 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.498553038 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.498568058 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.498745918 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.498759031 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.498805046 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.499754906 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.499775887 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.499824047 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.499833107 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.499869108 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.501079082 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.501123905 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.501172066 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.501179934 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.501215935 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.502710104 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.502724886 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.502780914 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.502789974 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.502824068 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.504494905 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.504508972 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.504570007 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.504576921 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.504611969 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.505644083 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.505659103 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.505718946 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.505727053 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.505760908 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.582536936 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.582560062 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.582685947 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.582711935 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.582756996 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.586143970 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.586158991 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.586220026 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.586227894 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.586268902 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.593067884 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.593082905 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.593126059 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.593135118 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.593147993 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.593170881 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.594763994 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.594778061 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.594821930 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.594829082 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.594871998 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.596472025 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.596493006 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.596528053 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.596534014 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.596560001 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.596575022 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.597008944 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.597031116 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.597073078 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.597080946 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.597091913 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.597116947 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.598917961 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.598932981 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.598990917 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.598999023 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.599034071 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.601291895 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.601308107 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.601356983 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.601365089 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.601407051 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.679032087 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.679055929 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.679128885 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.679138899 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.679174900 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.686407089 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.686422110 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.686475039 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.686482906 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.686520100 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.692976952 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.692991972 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.693044901 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.693053007 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.693094969 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.693872929 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.693887949 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.693933964 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.693941116 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.693979025 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.697406054 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.697421074 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.697473049 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.697480917 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.697515011 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.698782921 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.698798895 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.698851109 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.698858976 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.698892117 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.699840069 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.699853897 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.699904919 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.699913025 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.699949980 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.701397896 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.701415062 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.701488972 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.701499939 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.701536894 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.775629997 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.775650978 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.775729895 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.775754929 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.775793076 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.779551983 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.779567003 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.779628038 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.779635906 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.779675961 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.786210060 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.786222935 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.786324024 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.786335945 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.786385059 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.787286997 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.787300110 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.787348986 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.787357092 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.787389040 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.790607929 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.790625095 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.790676117 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.790683985 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.790721893 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.791760921 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.791774035 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.791821957 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.791830063 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.791867018 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.792958975 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.792972088 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.793013096 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.793021917 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.793041945 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.793055058 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.793570042 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.793582916 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.793632030 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.793638945 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.793678999 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.875190973 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.875251055 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.875345945 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.875356913 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.875394106 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.879559040 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.879575968 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.879637957 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.879653931 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.879687071 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.882900000 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.882914066 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.883187056 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.883255959 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.883321047 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.886060953 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.886075020 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.886136055 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.886146069 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.886182070 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.888189077 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.888202906 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.888289928 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.888297081 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.888339043 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.891052961 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.891067982 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.891124010 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.891132116 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.891170025 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.893769026 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.893785000 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.893842936 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.893851995 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.893889904 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.894526958 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.894541025 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.894598961 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.894607067 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.894644022 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.972631931 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.972695112 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.972769976 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.972785950 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.972800970 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.972820997 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.977457047 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.977473021 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.977536917 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.977546930 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.977591038 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.978996038 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.979013920 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.979073048 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.979082108 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.979120970 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.979868889 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.979887962 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.979939938 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.979948997 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.979988098 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.984422922 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.984436989 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.984494925 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.984503984 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.984546900 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.985846043 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.985858917 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.985920906 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.985929966 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.985969067 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.987848997 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.987863064 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.987895012 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.987926960 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.987957001 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.987967968 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:28.987982035 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:28.987982035 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.032892942 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.104960918 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.104988098 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.105036974 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.105046988 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.105077028 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.105086088 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.111566067 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.111582041 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.111654997 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.111666918 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.111704111 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.112086058 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.112102032 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.112154007 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.112163067 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.112185001 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.112202883 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.113790035 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.113806009 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.113867044 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.113878012 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.113914967 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.113974094 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.113986969 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.114034891 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.114043951 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.114082098 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.115571022 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.115586042 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.115633965 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.115643024 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.115685940 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.115916014 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.115967989 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.116015911 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.116024017 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.116043091 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.116060972 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.117644072 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.117660999 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.117703915 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.117712975 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.117753029 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.202064991 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.202131033 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.202275038 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.202286959 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.202342987 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.207695007 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.207709074 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.207762957 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.207772017 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.207809925 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.207959890 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.207979918 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.208028078 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.208038092 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.208075047 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.209378004 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.209391117 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.209429026 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.209436893 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.209460974 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.209479094 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.210448027 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.210464001 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.210516930 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.210525990 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.210566044 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.211249113 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.211262941 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.211313963 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.211323023 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.211360931 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.212018967 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.212032080 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.212080002 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.212089062 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.212125063 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.213084936 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.213099003 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.213151932 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.213160992 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.213200092 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.306133986 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.306157112 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.306267023 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.306283951 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.306328058 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.315736055 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.315757990 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.315807104 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.315820932 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.315834045 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.315855980 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.316255093 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.316268921 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.316317081 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.316325903 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.316366911 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.318365097 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.318380117 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.318449020 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.318458080 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.318495035 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.321105957 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.321121931 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.321171999 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.321181059 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.321217060 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.326838017 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.326879025 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.326910019 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.326917887 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.326932907 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.326951981 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.327016115 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.327059984 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.327080011 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.327088118 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.327126026 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.327126026 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.332190037 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.332231998 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.332261086 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.332268953 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.332284927 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.332312107 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.415853024 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.415867090 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.415978909 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.415990114 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.416038036 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.417357922 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.417380095 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.417432070 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.417442083 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.417484045 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.419533014 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.419548035 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.419604063 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.419612885 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.419651031 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.422389984 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.422404051 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.422449112 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.422458887 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.422478914 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.422492981 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.424196959 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.424210072 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.424258947 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.424268007 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.424309969 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.426969051 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.426983118 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.427031994 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.427041054 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.427078962 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.428504944 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.428519011 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.428570032 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.428579092 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.428617954 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.429146051 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.429160118 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.429212093 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.429220915 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.429258108 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.815763950 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.815784931 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.815913916 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.815944910 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.815987110 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.818125010 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.818140030 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.818214893 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.818226099 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.818265915 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.820076942 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.820091963 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.820156097 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.820164919 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.820207119 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.822062969 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.822078943 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.822139025 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.822149992 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.822173119 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.822181940 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.824358940 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.824373960 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.824419022 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.824426889 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.824451923 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.824461937 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.825541019 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.825556040 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.825603008 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.825612068 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.825624943 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.825650930 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.827768087 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.827784061 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.827830076 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.827840090 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.827862978 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.827872992 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.829636097 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.829651117 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.829726934 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.829737902 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.829771996 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.844300985 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.844316006 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.844366074 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.844377041 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.844408035 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.844419003 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.844852924 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.844867945 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.844918966 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.844928026 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.844938993 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.844966888 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.846550941 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.846565008 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.846617937 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.846626997 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.846664906 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.847601891 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.847616911 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.847661018 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.847668886 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.847682953 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.849061012 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.849078894 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.849097967 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.849107027 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.849119902 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.849165916 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.849633932 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.849649906 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.849687099 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.849695921 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.849718094 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.849729061 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.851591110 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.851605892 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.851665974 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.851675034 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.851711988 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.852401018 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.852420092 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.852471113 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.852488041 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.852524042 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.863908052 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.863922119 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.863982916 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.863992929 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.864033937 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.866431952 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.866446018 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.866501093 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.866511106 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.866547108 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.866848946 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.866863012 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.866909027 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.866918087 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.866955042 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.867611885 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.867626905 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.867671967 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.867680073 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.867702961 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.867712021 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.869390965 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.869405031 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.869451046 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.869461060 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.869498968 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.870280027 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.870295048 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.870337963 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.870347023 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.870383024 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.872051001 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.872065067 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.872111082 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.872119904 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.872155905 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.872992039 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.873007059 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.873050928 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.873059988 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.873110056 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.881845951 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.881865978 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.881912947 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.881921053 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.881933928 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.881957054 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.882400990 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.882416964 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.882461071 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.882468939 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.882509947 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.882597923 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.882611990 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.882653952 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.882663012 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.882695913 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.882891893 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.882905960 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.882950068 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.882958889 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.882993937 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.885102034 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.885164022 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.885176897 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.885186911 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.885214090 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.885226965 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.885679960 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.885723114 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.885754108 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.885761976 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.885773897 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.885797024 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.887231112 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.887284994 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.887310028 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.887317896 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.887330055 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.887346983 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.888647079 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.888696909 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.888712883 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.888722897 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.888804913 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.888804913 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.906661987 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.906704903 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.906754017 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.906763077 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.906790972 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.906809092 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.908585072 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.908623934 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.908648968 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.908655882 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.908682108 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.908700943 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.912749052 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.912791014 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.912815094 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.912823915 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.912834883 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.912854910 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.913522959 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.913564920 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.913589001 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.913595915 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.913616896 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.913626909 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.915045023 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.915085077 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.915108919 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.915117025 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.915127993 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.915153027 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.917989016 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.918028116 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.918057919 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.918066025 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.918078899 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.918100119 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.924206972 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.924248934 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.924289942 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.924320936 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.924340010 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.924360991 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.925210953 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.925251961 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.925282955 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.925295115 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.925309896 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.925333023 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.997728109 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.997773886 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.997816086 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.997850895 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:29.997864962 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:29.997884989 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.002157927 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.002201080 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.002223969 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.002232075 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.002249002 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.002264977 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.004014969 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.004060030 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.004076958 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.004085064 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.004110098 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.004121065 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.004153967 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.004194021 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.004205942 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.004215002 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.004235029 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.004244089 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.006431103 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.006473064 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.006490946 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.006500006 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.006537914 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.006555080 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.006865978 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.006920099 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.006937027 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.006944895 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.006959915 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.007065058 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.007096052 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.007103920 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.007118940 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.007128954 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.007143021 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.007164955 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.007179976 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.007225037 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.009212017 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.009253979 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.009272099 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.009279966 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.009363890 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.091429949 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.091494083 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.091511965 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.091525078 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.091547966 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.091558933 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.095084906 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.095133066 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.095164061 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.095170975 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.095184088 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.095210075 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.096817017 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.096858978 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.096884966 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.096895933 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.096911907 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.096931934 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.097955942 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.098000050 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.098020077 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.098027945 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.098052025 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.098061085 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.100569963 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.100611925 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.100632906 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.100641012 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.100651979 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.100681067 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.100769997 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.100809097 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.100827932 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.100836039 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.100858927 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.100873947 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.101485968 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.101547003 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.101562023 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.101619005 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.102252960 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.102293015 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.102313042 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.102320910 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.102340937 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.102359056 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.192682028 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.192743063 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.192764044 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.192781925 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.192797899 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.192816019 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.193228006 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.193268061 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.193294048 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.193301916 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.193325996 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.193335056 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.194061041 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.194102049 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.194137096 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.194144964 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.194166899 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.194185972 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.195688009 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.195744038 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.195765972 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.195774078 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.195785999 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.195810080 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.199091911 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.199147940 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.199178934 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.199187994 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.199199915 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.199220896 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.199714899 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.199754953 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.199781895 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.199790001 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.199805021 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.199820995 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.202989101 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.203032017 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.203072071 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.203083038 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.203102112 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.203114033 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.205584049 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.205629110 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.205667973 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.205677986 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.205702066 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.205713034 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.295238972 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.295255899 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.295488119 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.295505047 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.295550108 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.296284914 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.296298027 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.296353102 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.296363115 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.296425104 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.297339916 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.297354937 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.297401905 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.297410965 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.297447920 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.297704935 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.297719955 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.297766924 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.297775030 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.297812939 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.302283049 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.302324057 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.302356005 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.302364111 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.302386999 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.302397013 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.303127050 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.303167105 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.303193092 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.303200960 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.303214073 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.303237915 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.304166079 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.304189920 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.304294109 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.304302931 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.304346085 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.304907084 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.304928064 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.305006027 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.305015087 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.305057049 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.401393890 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.401421070 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.401484966 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.401499033 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.401526928 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.401549101 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.402920961 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.402944088 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.402991056 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.403000116 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.403038025 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.405261040 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.405280113 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.405318975 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.405327082 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.405340910 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.405361891 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.410299063 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.410327911 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.410378933 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.410387993 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.410419941 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.410437107 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.410728931 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.410748959 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.410799980 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.410806894 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.410824060 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.410840988 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.412363052 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.412385941 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.412444115 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.412452936 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.412475109 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.412489891 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.417571068 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.417592049 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.417665958 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.417675018 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.417711020 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.421226025 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.421247005 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.421293974 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.421302080 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.421314001 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.421333075 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.495656967 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.495690107 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.495728970 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.495738983 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.495750904 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.495778084 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.504436970 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.504463911 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.504503965 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.504511118 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.504524946 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.504548073 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.506079912 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.506100893 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.506136894 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.506145000 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.506160975 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.506179094 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.506968021 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.506988049 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.507026911 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.507035971 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.507046938 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.507071018 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.509187937 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.509249926 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.509262085 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.509313107 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.513523102 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.513541937 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.513581038 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.513588905 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.513602972 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.513621092 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.514269114 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.514288902 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.514324903 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.514333963 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.514347076 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.514367104 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.516927958 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.516947985 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.516992092 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.517003059 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.517014027 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.517035961 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.610682011 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.610703945 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.610848904 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.610873938 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.610946894 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.611782074 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.611802101 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.611855984 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.611865044 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.611906052 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.614837885 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.614866972 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.614928961 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.614938974 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.614974022 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.624927998 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.624955893 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.625009060 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.625019073 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.625041962 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.625061989 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.626254082 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.626274109 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.626306057 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.626312971 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.626334906 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.626343012 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.630386114 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.630414963 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.630454063 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.630462885 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.630491018 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.630503893 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.633002043 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.633040905 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.633065939 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.633073092 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.633094072 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.633110046 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.634536982 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.634557009 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.634596109 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.634603024 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.634625912 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.634637117 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.709685087 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.709708929 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.709770918 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.709783077 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.709816933 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.710716963 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.711330891 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.711358070 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.711391926 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.711400032 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.711417913 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.711437941 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.713485956 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.713505983 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.713545084 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.713551998 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.713573933 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.713586092 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.715981960 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.716001987 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.716051102 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.716058969 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.716087103 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.716095924 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.718025923 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.718049049 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.718103886 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.718111992 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.718125105 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.718143940 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.719607115 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.719626904 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.719686031 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.719696045 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.719737053 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.723426104 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.723484039 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.723509073 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.723517895 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.723546028 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.723558903 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.725541115 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.725584030 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.725615978 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.725624084 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.725651979 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.725670099 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.802660942 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.802711964 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.802731037 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.802745104 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.802761078 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.802774906 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.808372974 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.808428049 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.808463097 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.808470964 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.808489084 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.808509111 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.810482025 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.810523987 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.810548067 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.810555935 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.810570002 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.810578108 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.810605049 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.812642097 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.812681913 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.812712908 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.812721014 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.812747955 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.812762022 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.813860893 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.813900948 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.813940048 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.813985109 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.814003944 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.814035892 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.817894936 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.817934990 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.817980051 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.817989111 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.818018913 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.818030119 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.818878889 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.818917990 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.818985939 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.818985939 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.819015026 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.819056988 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.819988012 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.820031881 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.820065975 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.820074081 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.820102930 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.820121050 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.908621073 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.908639908 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.908708096 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.908750057 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.908793926 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.914494991 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.914510965 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.914566994 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.914577961 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.914617062 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.926492929 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.926511049 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.926563978 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.926575899 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.926614046 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.931612015 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.931627989 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.931684971 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.931694031 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.931727886 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.933249950 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.933264017 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.933315992 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.933326960 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.933351994 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.933362007 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.940545082 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.940561056 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.940722942 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.940733910 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.940805912 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.941616058 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.941631079 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.941692114 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.941706896 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.941744089 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.943409920 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.943430901 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.943470001 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.943479061 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:30.943497896 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:30.943516970 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.000478029 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.000505924 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.000716925 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.000787973 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.000861883 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.001032114 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.001045942 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.001111031 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.001128912 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.001183033 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.003810883 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.003827095 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.003900051 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.003910065 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.003951073 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.007798910 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.007814884 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.007879972 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.007888079 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.008074999 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.011219025 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.011234045 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.011313915 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.011329889 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.011384964 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.013878107 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.013891935 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.013951063 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.013957977 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.014010906 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.016864061 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.016879082 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.016937017 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.016944885 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.016984940 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.018621922 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.018646955 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.018707037 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.018713951 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.018757105 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.103009939 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.103027105 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.103096962 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.103106022 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.103149891 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.105739117 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.105751991 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.105817080 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.105824947 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.105864048 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.106712103 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.106724977 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.106781960 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.106789112 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.106828928 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.113626957 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.113641024 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.113768101 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.113782883 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.113836050 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.114029884 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.114053965 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.114093065 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.114108086 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.114141941 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.114162922 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.118551016 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.118566036 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.118649960 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.118658066 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.118697882 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.122195959 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.122212887 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.122268915 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.122277021 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.122329950 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.131006956 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.131026030 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.131103992 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.131119013 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.131170988 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.201400995 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.201417923 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.201630116 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.201646090 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.201692104 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.202507019 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.202522039 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.202584028 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.202593088 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.202637911 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.205838919 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.205892086 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.205944061 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.205955982 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.206003904 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.209861040 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.209907055 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.209954977 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.209964991 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.209991932 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.210019112 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.211159945 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.211199045 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.211244106 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.211251020 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.211297035 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.211352110 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.211393118 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.211417913 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.211425066 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.211448908 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.211473942 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.214236975 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.214277983 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.214313984 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.214320898 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.214366913 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.220788956 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.220830917 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.220882893 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.220890999 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.220951080 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.311518908 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.311580896 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.311749935 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.311784983 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.311798096 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.311836958 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.313329935 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.313384056 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.313424110 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.313431025 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.313477993 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.314606905 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.314647913 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.314678907 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.314687014 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.314711094 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.314735889 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.316278934 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.316329002 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.316359997 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.316368103 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.316399097 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.316420078 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.317517996 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.317559958 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.317589998 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.317598104 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.317631006 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.317651987 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.319569111 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.319610119 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.319643974 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.319652081 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.319679022 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.319701910 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.322061062 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.322118998 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.322154999 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.322161913 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.322192907 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.322216988 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.324311018 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.324352980 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.324379921 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.324388027 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.324423075 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.324441910 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.417355061 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.417484045 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.417557001 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.417593002 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.417609930 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.417642117 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.418947935 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.418991089 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.419025898 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.419037104 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.419051886 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.419080973 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.420300961 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.420350075 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.420382977 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.420392990 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.420408010 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.420420885 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.421863079 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.421909094 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.421932936 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.421941042 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.421953917 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.421977043 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.422959089 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.423002005 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.423027992 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.423036098 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.423052073 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.423069954 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.425192118 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.425234079 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.425265074 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.425271988 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.425298929 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.425312042 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.426650047 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.426697969 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.426723957 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.426732063 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.426743984 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.426769018 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.427531958 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.427575111 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.427602053 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.427609921 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.427622080 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.427643061 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.528341055 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.528403044 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.528507948 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.528522015 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.528574944 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.528574944 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.529555082 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.529598951 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.529628038 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.529637098 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.529668093 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.529685974 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.530477047 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.530518055 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.530541897 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.530550003 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.530597925 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.530597925 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.532111883 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.532171011 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.532179117 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.532201052 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.532242060 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.532243013 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.533274889 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.533318043 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.533354044 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.533361912 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.533390045 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.533410072 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.536045074 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.536101103 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.536133051 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.536140919 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.536166906 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.536184072 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.538789988 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.538831949 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.538856030 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.538863897 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.538902044 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.538902044 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.539266109 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.539309025 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.539328098 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.539336920 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.539356947 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.539377928 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.633918047 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.633960962 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.634032011 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.634109974 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.634150028 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.634175062 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.636204958 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.636245966 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.636285067 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.636306047 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.636331081 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.636349916 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.639018059 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.639062881 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.639105082 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.639115095 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.639146090 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.639154911 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.642652988 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.642693996 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.642731905 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.642745972 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.642777920 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.642777920 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.642801046 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.647502899 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.647545099 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.647608042 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.647624016 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.647648096 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.647665977 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.652632952 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.652676105 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.652714014 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.652734041 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.652745008 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.652769089 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.658198118 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.658240080 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.658282042 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.658304930 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.658329010 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.658348083 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.663604021 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.663647890 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.663692951 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.663707972 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.663724899 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.663744926 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.728719950 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.728781939 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.728817940 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.728827953 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.728871107 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.732778072 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.732820988 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.732852936 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.732861042 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.732873917 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.732892036 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.736314058 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.736356974 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.736385107 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.736393929 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.736407042 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.736429930 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.739720106 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.739804029 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.739811897 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.739835024 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.739864111 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.739873886 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.744033098 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.744158030 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.744168997 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.744184971 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.744220018 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.744234085 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.748986006 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.749006033 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.749063969 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.749074936 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.749110937 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.752907991 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.752923012 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.752985001 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.752995014 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.753030062 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.758459091 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.758474112 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.758531094 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.758539915 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.758577108 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.821686983 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.821705103 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.821811914 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.821827888 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.821871996 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.823628902 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.823643923 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.823707104 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.823715925 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.823760033 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.826376915 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.826392889 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.826446056 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.826455116 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.826498032 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.829052925 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.829068899 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.829123974 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.829133034 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.829176903 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.831768036 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.831784010 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.831831932 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.831841946 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.831865072 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.831891060 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.834507942 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.834525108 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.834583044 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.834594011 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.834638119 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.837419987 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.837434053 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.837488890 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.837498903 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.837541103 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.840686083 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.840699911 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.840755939 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.840765953 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.840804100 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.952951908 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.952996969 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.953093052 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.953139067 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.953197002 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.960438967 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.960464954 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.960635900 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.960645914 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.960715055 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.965663910 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.965687037 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.965764046 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.965773106 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.965823889 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.972294092 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.972333908 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.972464085 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.972475052 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.972570896 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.979195118 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.979211092 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.979310036 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.979325056 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.979374886 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.987709045 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.987724066 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.987809896 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.987822056 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.987874031 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.991050959 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.991070986 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.991163015 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.991173983 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.991220951 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.994132996 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.994153976 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.994227886 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:31.994237900 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:31.994291067 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.095257044 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.095282078 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.095470905 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.095495939 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.095619917 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.105916977 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.105937958 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.106020927 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.106041908 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.106090069 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.109035969 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.109056950 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.109117985 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.109138012 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.109184027 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.115456104 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.115478992 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.115546942 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.115564108 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.115612984 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.119179010 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.119193077 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.119281054 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.119302988 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.119349003 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.126332998 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.126348972 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.126451969 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.126468897 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.126513004 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.131264925 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.131293058 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.131340981 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.131350040 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.131383896 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.131402969 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.137842894 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.137866020 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.137926102 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.137936115 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.137976885 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.190557003 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.190579891 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.190726995 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.190764904 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.190828085 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.194281101 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.194300890 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.194369078 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.194377899 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.194421053 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.196446896 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.196475029 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.196532965 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.196542978 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.196585894 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.201373100 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.201391935 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.201461077 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.201477051 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.201530933 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.204467058 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.204500914 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.204536915 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.204545021 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.204580069 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.204602957 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.212589979 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.212609053 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.212683916 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.212702036 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.212755919 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.218130112 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.218149900 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.218199968 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.218214989 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.218246937 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.218266964 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.220838070 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.220858097 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.220927000 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.220937967 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.220990896 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.289964914 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.289988041 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.290206909 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.290230036 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.290291071 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.294724941 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.294744015 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.294819117 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.294835091 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.294888020 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.296922922 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.296941996 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.297003031 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.297013044 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.297055006 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.300241947 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.300260067 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.300321102 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.300329924 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.300378084 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.303174973 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.303194046 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.303257942 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.303272963 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.303323984 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.308666945 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.308687925 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.308734894 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.308748960 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.308779955 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.308798075 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.314094067 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.314112902 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.314177036 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.314193010 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.314246893 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.322998047 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.323018074 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.323123932 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.323133945 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.323204041 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.384743929 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.384764910 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.384876013 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.384937048 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.384984016 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.391486883 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.391515017 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.391587019 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.391597033 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.391640902 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.396574974 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.396595955 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.396663904 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.396678925 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.396749020 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.401988983 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.402009010 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.402079105 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.402108908 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.402165890 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.406405926 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.406424999 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.406497002 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.406512022 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.406569958 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.409892082 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.409914970 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.409977913 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.409986973 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.410029888 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.412004948 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.412025928 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.412072897 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.412081957 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.412113905 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.412137032 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.413975000 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.413995028 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.414045095 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.414052963 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.414083958 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.414113998 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.482083082 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.482106924 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.482228041 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.482247114 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.482304096 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.485733986 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.485754013 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.485829115 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.485845089 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.485896111 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.490495920 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.490514994 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.490652084 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.490667105 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.490734100 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.490735054 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.493555069 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.493572950 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.493710041 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.493710041 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.493719101 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.493937016 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.496185064 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.496206999 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.496247053 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.496254921 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.496284962 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.496310949 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.498769045 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.498790026 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.498867989 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.498877048 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.498914957 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.501426935 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.501447916 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.501485109 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.501493931 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.501516104 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.501562119 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.502535105 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.502556086 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.502623081 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.502631903 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.502697945 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.577368021 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.577394962 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.577462912 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.577475071 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.577516079 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.577541113 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.583118916 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.583139896 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.583187103 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.583195925 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.583234072 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.583251953 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.583324909 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.583348989 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.583380938 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.583389044 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.583420992 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.583440065 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.586620092 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.586639881 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.586684942 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.586694002 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.586711884 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.586754084 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.587980032 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.588001013 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.588107109 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.588144064 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.588196993 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.589355946 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.589385033 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.589425087 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.589432955 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.589468002 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.589504004 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.591164112 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.591195107 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.591229916 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.591238976 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.591269016 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.591286898 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.594254971 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.594285965 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.594324112 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.594331980 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.594367981 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.594392061 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.671785116 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.671813965 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.672058105 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.672084093 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.672148943 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.673718929 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.673741102 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.673791885 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.673800945 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.673846960 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.676806927 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.676827908 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.676878929 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.676889896 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.676904917 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.676934004 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.679064989 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.679088116 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.679171085 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.679183960 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.679229021 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.680747986 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.680769920 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.680814028 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.680823088 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.680854082 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.680876970 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.685306072 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.685336113 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.685410976 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.685445070 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.685497999 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.688122988 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.688149929 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.688196898 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.688206911 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.688235998 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.688257933 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.690898895 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.690931082 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.691010952 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.691020966 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.691063881 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.778139114 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.778161049 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.778237104 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.778253078 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.778304100 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.780428886 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.780467987 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.780508995 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.780518055 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.780549049 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.780572891 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.784284115 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.784302950 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.784353018 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.784362078 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.784380913 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.784426928 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.789016962 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.789041042 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.789097071 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.789105892 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.789128065 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.789145947 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.792829990 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.792850971 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.792913914 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.792928934 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.792970896 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.797081947 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.797102928 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.797151089 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.797158957 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.797185898 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.797225952 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.800640106 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.800658941 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.800704956 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.800712109 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.800735950 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.800759077 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.804088116 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.804110050 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.804155111 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.804162979 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.804205894 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.869363070 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.869394064 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.869469881 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.869481087 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.869544029 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.872384071 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.872401953 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.872479916 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.872493982 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.872549057 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.876552105 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.876571894 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.876625061 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.876633883 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.876648903 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.876677990 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.878473043 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.878494024 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.878669977 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.878683090 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.878737926 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.880851984 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.880872011 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.880920887 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.880929947 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.880966902 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.880990028 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.884012938 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.884033918 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.884151936 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.884162903 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.884221077 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.891196012 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.891221046 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.891309023 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.891320944 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.891366959 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.896372080 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.896392107 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.896475077 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.896495104 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.896543980 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.966566086 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.966588974 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.966690063 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.966718912 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.966869116 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.968887091 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.968905926 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.968952894 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.968962908 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.968988895 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.969003916 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.970473051 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.970494032 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.970536947 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.970546007 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.970570087 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.970585108 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.972232103 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.972251892 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.972291946 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.972301006 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.972316980 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.972336054 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.975076914 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.975099087 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.975138903 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.975147963 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.975172997 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.975186110 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.976658106 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.976676941 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.976711035 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.976718903 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.976746082 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.976763010 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.980994940 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.981014967 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.981062889 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.981074095 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.981089115 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.981111050 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.984466076 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.984500885 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.984530926 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.984540939 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:32.984565020 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.984577894 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:32.995729923 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.063879967 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.063905001 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.064059019 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.064086914 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.064173937 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.066704988 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.066725016 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.066780090 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.066788912 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.066813946 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.066823959 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.070261002 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.070307970 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.070321083 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.070327044 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.070355892 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.070369959 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.073846102 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.073867083 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.073944092 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.073945045 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.073980093 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.074130058 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.074157000 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.074179888 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.074203014 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.074213028 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.074254990 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.074287891 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.074347019 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.078283072 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.078311920 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.078371048 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.078380108 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.078391075 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.078432083 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.081522942 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.081547022 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.081706047 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.081713915 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.081723928 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.081748962 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.081754923 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.081763983 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.081785917 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.081828117 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.156335115 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.156359911 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.156423092 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.156445026 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.156455040 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.156486034 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.158428907 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.158448935 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.158510923 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.158519030 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.158557892 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.160407066 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.160427094 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.160479069 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.160490036 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.160520077 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.163289070 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.163310051 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.163347006 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.163355112 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.163378954 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.163388968 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.165397882 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.165420055 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.165462017 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.165469885 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.165484905 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.165503979 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.167145014 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.167165041 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.167212963 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.167221069 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.167257071 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.169749975 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.169773102 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.169822931 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.169831038 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.169866085 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.175546885 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.175566912 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.175611019 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.175617933 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.175626993 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.175654888 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.262923002 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.262944937 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.263015032 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.263031960 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.263072014 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.265356064 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.265376091 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.265451908 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.265451908 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.265460014 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.265497923 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.268618107 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.268637896 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.268711090 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.268719912 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.268758059 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.274239063 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.274257898 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.274329901 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.274338007 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.274374962 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.276633024 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.276662111 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.276719093 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.276726961 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.276765108 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.277065992 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.277086020 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.277128935 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.277143002 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.277178049 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.281188011 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.281207085 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.281279087 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.281290054 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.281328917 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.283226967 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.283246994 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.283313990 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.283323050 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.283358097 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.348512888 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.348541975 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.348617077 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.348633051 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.348699093 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.351917982 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.351939917 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.352001905 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.352010965 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.352050066 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.354610920 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.354631901 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.354676008 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.354684114 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.354707956 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.354722023 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.356559992 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.356579065 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.356621027 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.356628895 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.356647015 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.356667042 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.357398987 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.357418060 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.357456923 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.357465029 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.357481956 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.357502937 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.359271049 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.359291077 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.359344959 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.359378099 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.359425068 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.361038923 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.361061096 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.361108065 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.361119032 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.361155987 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.366245031 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.366264105 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.366322994 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.366338015 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.366379976 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.441350937 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.441380024 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.441490889 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.441510916 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.441565037 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.445497990 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.445518970 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.445580959 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.445590973 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.445635080 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.447494030 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.447515965 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.447556019 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.447565079 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.447594881 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.447614908 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.449287891 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.449318886 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.449361086 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.449369907 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.449398994 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.449419022 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.450234890 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.450258970 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.450299978 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.450308084 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.450335026 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.450360060 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.451721907 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.451746941 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.451783895 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.451792955 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.451821089 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.451842070 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.453438997 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.453459978 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.453500032 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.453507900 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.453540087 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.453558922 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.459081888 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.459105015 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.459168911 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.459178925 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.459202051 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.459263086 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.538753986 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.538774967 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.538871050 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.538886070 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.538933039 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.540205002 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.540227890 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.540292025 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.540301085 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.540344954 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.541821003 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.541841984 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.541913033 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.541922092 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.541964054 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.547780991 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.547801018 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.547863960 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.547873020 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.547914982 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.548557997 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.548577070 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.548640013 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.548649073 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.548749924 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.549977064 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.549995899 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.550060034 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.550076962 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.550126076 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.550579071 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.550599098 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.550654888 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.550663948 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.550707102 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.553908110 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.553925991 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.553998947 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.554008007 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.554089069 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.639350891 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.639379978 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.639466047 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.639497042 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.639544964 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.640415907 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.640438080 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.640537977 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.640548944 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.640595913 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.641500950 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.641529083 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.641583920 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.641592979 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.641633987 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.646835089 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.646859884 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.646905899 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.646914005 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.646971941 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.646971941 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.647937059 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.647959948 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.648003101 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.648013115 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.648046017 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.648078918 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.649102926 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.649149895 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.649204016 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.649214029 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.649256945 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.650368929 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.650394917 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.650441885 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.650450945 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.650485992 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.650507927 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.653177023 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.653198004 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.653274059 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.653283119 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.653320074 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.733443975 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.733469963 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.733630896 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.733664989 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.733714104 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.734622002 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.734643936 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.734708071 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.734716892 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.734761953 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.735927105 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.735949039 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.736000061 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.736008883 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.736041069 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.736068964 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.739537001 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.739556074 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.739617109 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.739626884 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.739670992 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.740209103 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.740227938 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.740284920 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.740293980 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.740344048 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.741108894 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.741170883 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.741230011 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.741239071 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.741278887 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.741918087 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.741939068 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.742017031 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.742026091 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.742070913 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.744064093 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.744085073 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.744142056 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.744151115 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.744194031 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.829632044 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.829654932 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.829787016 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.829823971 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.829874039 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.832062006 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.832091093 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.832150936 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.832160950 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.832205057 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.832772970 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.832792997 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.832869053 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.832878113 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.832922935 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.834311008 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.834331036 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.834389925 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.834398985 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.834440947 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.835397959 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.835417986 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.835468054 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.835478067 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.835515022 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.835531950 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.836112976 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.836132050 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.836196899 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.836205006 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.836250067 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.836719990 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.836744070 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.836760044 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.836767912 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.836791992 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.836837053 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.839503050 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.839523077 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.839576960 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.839593887 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.839624882 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.839643002 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.926512957 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.926538944 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.926668882 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.926702023 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.926753044 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.928282022 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.928303003 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.928369999 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.928386927 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.928431988 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.929711103 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.929730892 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.929779053 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.929788113 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.929821014 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.929847002 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.932257891 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.932277918 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.932332993 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.932339907 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.932388067 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.933572054 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.933598995 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.933644056 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.933651924 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.933685064 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.933706999 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.934973955 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.934993029 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.935043097 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.935049057 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.935082912 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.935102940 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.937309980 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.937354088 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.937402964 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.937421083 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.937439919 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.937463999 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.939155102 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.939174891 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.939225912 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.939233065 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:33.939249992 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:33.939270973 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.019706011 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.019742966 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.019799948 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.019829035 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.019841909 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.019866943 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.020791054 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.020814896 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.020855904 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.020863056 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.020889997 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.020901918 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.022027969 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.022058010 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.022089958 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.022097111 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.022123098 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.022142887 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.025057077 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.025121927 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.025135994 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.025158882 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.025182009 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.025201082 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.028002024 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.028064013 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.028076887 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.028101921 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.028116941 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.028148890 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.028709888 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.028732061 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.028773069 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.028779984 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.028800011 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.028815985 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.029308081 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.029335022 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.029365063 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.029371977 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.029393911 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.029413939 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.074322939 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.074378014 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.074409008 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.074451923 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.074490070 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.074513912 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.114809990 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.114856958 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.114912987 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.114929914 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.114959955 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.114980936 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.115605116 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.115675926 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.115680933 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.115705967 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.115734100 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.115757942 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.117470980 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.117522001 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.117541075 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.117548943 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.117568970 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.117585897 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.120090961 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.120136023 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.120166063 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.120172977 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.120198011 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.120210886 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.123091936 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.123133898 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.123279095 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.123290062 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.123331070 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.125149012 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.125194073 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.125226974 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.125236988 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.125257015 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.125277996 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.126677036 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.126718044 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.126746893 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.126754045 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.126782894 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.126801968 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.172169924 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.172329903 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.172379971 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.172388077 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.172415018 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.173454046 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.206722021 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.206769943 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.206825018 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.206836939 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.206867933 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.206882000 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.208214045 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.208259106 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.208297014 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.208303928 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.208328962 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.208339930 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.209804058 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.209862947 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.209877968 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.209884882 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.209923029 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.212611914 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.212652922 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.212680101 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.212687969 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.212716103 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.212816954 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.216106892 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.216200113 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.216233969 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.216240883 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.216267109 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.216279984 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.219554901 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.219626904 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.219762087 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.219769955 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.219809055 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.220788956 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.220830917 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.220861912 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.220869064 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.220894098 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.220907927 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.265752077 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.265796900 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.265840054 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.265856028 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.265882969 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.265903950 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.299843073 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.299901962 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.299972057 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.299992085 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.300019026 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.300059080 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.301305056 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.301350117 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.301398993 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.301407099 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.301448107 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.303388119 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.303431034 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.303476095 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.303486109 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.303495884 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.303524017 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.306525946 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.306569099 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.306610107 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.306619883 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.306647062 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.306669950 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.309828997 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.309870005 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.309900999 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.309910059 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.309940100 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.309957027 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.311369896 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.311410904 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.311456919 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.311464071 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.311491013 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.311505079 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.315798998 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.315890074 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.315917969 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.315928936 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.316011906 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.316029072 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.365539074 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.365583897 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.365628958 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.365639925 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.365684986 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.397406101 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.397449017 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.397510052 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.397532940 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.397543907 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.397567034 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.398521900 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.398565054 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.398607016 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.398613930 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.398624897 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.398653984 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.400576115 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.400619984 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.400651932 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.400659084 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.400674105 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.400703907 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.405572891 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.405616045 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.405653000 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.405659914 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.405669928 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.405694008 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.411101103 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.411175013 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.411184072 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.411221027 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.411236048 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.411264896 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.412265062 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.412332058 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.412332058 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.412357092 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.412388086 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.412401915 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.418328047 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.418369055 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.418391943 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.418400049 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.418427944 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.418437004 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.462620020 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.462667942 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.462707043 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.462717056 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.462740898 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.462763071 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.493351936 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.493432999 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.493437052 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.493460894 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.493496895 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.493505955 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.494528055 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.494570017 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.494607925 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.494616032 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.494671106 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.494671106 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.496689081 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.496728897 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.496766090 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.496773005 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.496782064 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.496809959 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.503844023 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.503885031 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.503927946 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.503936052 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.503943920 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.503972054 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.514497042 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.514539957 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.514745951 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.514745951 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.514755011 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.514807940 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.515160084 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.515214920 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.515243053 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.515249968 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.515275002 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.515294075 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.519165993 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.519207954 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.519263983 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.519273043 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.519300938 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.519320011 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.555155993 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.555201054 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.555362940 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.555373907 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.555419922 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.594048977 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.594110012 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.594227076 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.594228029 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.594264030 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.594310999 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.597784996 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.597825050 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.597862005 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.597876072 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.597901106 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.597925901 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.600004911 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.600045919 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.600076914 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.600086927 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.600107908 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.600136995 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.604123116 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.604168892 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.604195118 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.604218960 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.604231119 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.604254007 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.614953041 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.614995956 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.615025997 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.615036964 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.615063906 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.615091085 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.617125034 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.617165089 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.617192984 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.617202997 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.617239952 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.617239952 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.622275114 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.622317076 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.622345924 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.622355938 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.622379065 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.622390032 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.655153036 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.655199051 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.655281067 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.655311108 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.655330896 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.655356884 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.688540936 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.688590050 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.688652039 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.688673019 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.688704014 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.688715935 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.690953970 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.690995932 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.691032887 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.691040993 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.691066027 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.691078901 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.694390059 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.694432974 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.694459915 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.694468021 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.694479942 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.694500923 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.701433897 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.701477051 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.701508045 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.701519012 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.701535940 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.701555014 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.715410948 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.715440989 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.715521097 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.715537071 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.715579987 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.717423916 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.717442989 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.717506886 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.717516899 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.717554092 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.719243050 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.719264030 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.719305992 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.719315052 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.719341993 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.719360113 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.749470949 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.749512911 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.749608040 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.749649048 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.749666929 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.749695063 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.789695978 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.789740086 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.789781094 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.789792061 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.789825916 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.789844036 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.791781902 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.791826010 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.791860104 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.791867971 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.791894913 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.791908026 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.793836117 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.793883085 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.793911934 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.793919086 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.793943882 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.793967009 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.796123981 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.796169996 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.796196938 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.796205044 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.796225071 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.796248913 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.804907084 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.804949999 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.804991007 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.804999113 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.805030107 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.805041075 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.808111906 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.808151960 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.808192968 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.808201075 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.808219910 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.808235884 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.809595108 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.809640884 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.809667110 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.809674978 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.809696913 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.809715986 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.846230984 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.846278906 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.846412897 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.846437931 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.846478939 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.846479893 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.886480093 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.886521101 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.886559010 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.886586905 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.886601925 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.886622906 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.889219046 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.889260054 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.889292002 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.889298916 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.889326096 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.889342070 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.889357090 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.889400959 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.889422894 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.889431953 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.889446974 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.889484882 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.891697884 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.891777992 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.891787052 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.891813993 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.891844034 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.891861916 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.904551983 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.904594898 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.904630899 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.904637098 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.904664993 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.904684067 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.907119036 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.907166004 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.907196045 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.907202005 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.907227993 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.907247066 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.911081076 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.911119938 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.911166906 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.911174059 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.911201954 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.911230087 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.939373016 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.939416885 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.939486980 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.939522028 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.939538002 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.939567089 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.988915920 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.988961935 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.989015102 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.989046097 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.989068031 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.989089966 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.994965076 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.995035887 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.995074987 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.995110989 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.995129108 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.995152950 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.997317076 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.997358084 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.997399092 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:34.997407913 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:34.997467041 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.000633001 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.000674009 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.000718117 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.000727892 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.000742912 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.000767946 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.006772041 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.006814003 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.006879091 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.006892920 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.006912947 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.006923914 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.011496067 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.011538982 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.011590958 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.011603117 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.011631966 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.011652946 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.012159109 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.012200117 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.012227058 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.012234926 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.012265921 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.012284994 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.054070950 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.054121971 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.054182053 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.054197073 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.054213047 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.054229975 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.123183966 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.123229027 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.123444080 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.123445034 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.123462915 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.123505116 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.127384901 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.127445936 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.127454042 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.127471924 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.127510071 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.127526999 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.130290985 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.130377054 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.130377054 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.130402088 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.130431890 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.130445004 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.134583950 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.134632111 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.134655952 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.134673119 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.134690046 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.134720087 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.141520977 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.141570091 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.141591072 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.141598940 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.141627073 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.141638994 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.146332979 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.146373987 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.146393061 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.146400928 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.146430016 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.146444082 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.149516106 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.149560928 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.149580956 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.149589062 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.149616957 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.149626970 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.152072906 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.152115107 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.152128935 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.152137995 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.152172089 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.205807924 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.205857038 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.205895901 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.205905914 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.205986023 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.206084013 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.209721088 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.209764957 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.209794044 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.209805965 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.209822893 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.209845066 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.213179111 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.213223934 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.213242054 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.213255882 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.213291883 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.213304996 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.214651108 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.214728117 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.214735985 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.214751005 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.214782953 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.214799881 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.220242977 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.220284939 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.220330954 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.220340014 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.220355034 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.220365047 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.222316980 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.222357035 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.222378969 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.222387075 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.222415924 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.222450018 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.223865986 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.223912001 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.223931074 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.223939896 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.223962069 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.223978996 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.251252890 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.251303911 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.251359940 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.251383066 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.251404047 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.251425982 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.299709082 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.299751997 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.299808979 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.299833059 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.299854994 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.299877882 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.304523945 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.304580927 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.304621935 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.304631948 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.304667950 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.304687977 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.306231976 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.306279898 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.306297064 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.306307077 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.306323051 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.306341887 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.306351900 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.308059931 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.308100939 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.308134079 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.308142900 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.308166981 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.308185101 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.309603930 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.309705019 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.309726954 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.309735060 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.309758902 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.309776068 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.313987017 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.314029932 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.314091921 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.314102888 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.314130068 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.314138889 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.314794064 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.314835072 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.314865112 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.314872980 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.314897060 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.314914942 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.340378046 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.340452909 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.340478897 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.340538979 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.340565920 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.340580940 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.354150057 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.392620087 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.392662048 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.392708063 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.392720938 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.392749071 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.392757893 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.397102118 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.397145033 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.397171974 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.397181034 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.397197008 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.397211075 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.399976015 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.400019884 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.400047064 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.400054932 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.400073051 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.400093079 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.401956081 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.401995897 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.402026892 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.402034044 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.402049065 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.402070045 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.402998924 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.403040886 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.403067112 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.403074980 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.403088093 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.403109074 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.405313015 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.405359983 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.405378103 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.405389071 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.405410051 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.405421019 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.406647921 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.406688929 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.406749010 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.406758070 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.406771898 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.406800985 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.436882973 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.436933994 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.436990023 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.437010050 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.437024117 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.437048912 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.485721111 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.485797882 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.485865116 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.485878944 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.485892057 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.485950947 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.494048119 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.494105101 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.494144917 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.494153976 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.494195938 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.494195938 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.495795012 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.495851040 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.495888948 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.495897055 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.495930910 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.495943069 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.496851921 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.496896029 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.496934891 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.496942997 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.496975899 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.496999025 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.499990940 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.500040054 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.500087023 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.500096083 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.500119925 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.500134945 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.502062082 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.502113104 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.502146959 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.502155066 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.502187014 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.502196074 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.503140926 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.503184080 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.503218889 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.503226995 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.503252983 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.503262997 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.534113884 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.534177065 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.534215927 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.534224987 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.534255981 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.534265041 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.579380035 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.579416990 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.579586029 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.579597950 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.579639912 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.589680910 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.589709997 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.589764118 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.589772940 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.589799881 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.589809895 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.623857975 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.623887062 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.623939991 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.623949051 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.623975992 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.623986959 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.683610916 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.683645010 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.683701038 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.683713913 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.683736086 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.683751106 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.717637062 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.717668056 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.717756033 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.717767954 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.717809916 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.796972990 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.796998024 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.797096968 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.797143936 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.797197104 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.799021006 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.799040079 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.799118996 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.799144030 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.799185038 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.802010059 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.802030087 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.802071095 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.802089930 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.802099943 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.802124023 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.806627035 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.806647062 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.806706905 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.806715965 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.806735039 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.806755066 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.808691025 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.808712959 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.808760881 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.808768034 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.808793068 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.808804989 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.811137915 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.811177015 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.811212063 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.811217070 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.811244011 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.811253071 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.811255932 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.811269045 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.811295986 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.811297894 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.811309099 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.811342955 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.820005894 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.820025921 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.820082903 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.820090055 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.820116043 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.820132971 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.822402954 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.822422981 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.822460890 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.822467089 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.822490931 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.822504997 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.825092077 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.825110912 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.825145960 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.825153112 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.825176954 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.825186014 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.829195976 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.829216957 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.829252958 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.829260111 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.829276085 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.829291105 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.831789970 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.831809044 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.831876993 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.831886053 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.831922054 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.833539963 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.833573103 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.833620071 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.833626986 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.833635092 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.833661079 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.836469889 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.836498976 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.836568117 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.836574078 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.836611032 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.836616993 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.836673975 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.836694002 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.836728096 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.836734056 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.836756945 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.838124037 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.850910902 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.850940943 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.850986004 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.850995064 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.851006031 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.851033926 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.852618933 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.852641106 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.852672100 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.852679014 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.852708101 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.852708101 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.855393887 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.855415106 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.855464935 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.855472088 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.855505943 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.859776974 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.859800100 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.859836102 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.859843016 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.859853983 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.859873056 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.887109995 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.887130976 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.887186050 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.887192965 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.887218952 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.887231112 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.888667107 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.888689041 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.888726950 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.888734102 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.888752937 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.888772011 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.891129971 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.891154051 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.891210079 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.891216993 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.891252041 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.891408920 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.891429901 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.891577959 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.891585112 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.891624928 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.904521942 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.904551983 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.904586077 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.904593945 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.904625893 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.904638052 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.905148983 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.905172110 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.905200958 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.905206919 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.905232906 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.905245066 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.906609058 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.906629086 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.906657934 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.906666994 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.906689882 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.906702042 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.933552980 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.933573008 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.933607101 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.933614016 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.933646917 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.933660030 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.991904974 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.991949081 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.991981030 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.991997957 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.992014885 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.992039919 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.992908001 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.992952108 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.992984056 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.992990971 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.993009090 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.993021011 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.995198965 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.995240927 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.995270967 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.995276928 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.995321989 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.995321989 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.996570110 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.996633053 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.996646881 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.996665001 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:35.996694088 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:35.996694088 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.006237030 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.006280899 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.006324053 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.006337881 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.006355047 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.006376982 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.007529974 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.007574081 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.007607937 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.007613897 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.007635117 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.007647991 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.009464025 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.009505033 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.009536982 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.009545088 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.009566069 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.009581089 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.030913115 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.030956030 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.030966043 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.031012058 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.031019926 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.031053066 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.087161064 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.087230921 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.087275028 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.087311983 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.087328911 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.087352037 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.088009119 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.088053942 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.088082075 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.088090897 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.088104963 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.088131905 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.089607954 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.089651108 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.089680910 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.089689016 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.089699984 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.089725018 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.090519905 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.090565920 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.090593100 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.090600967 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.090612888 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.090642929 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.115592957 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.115652084 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.115689993 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.115703106 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.115716934 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.115761995 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.117085934 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.117127895 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.117161989 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.117171049 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.117196083 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.117224932 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.120125055 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.120167971 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.120199919 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.120208025 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.120234966 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.120254993 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.133240938 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.133289099 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.133342028 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.133349895 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.133394003 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.133414030 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.194835901 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.194869041 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.194920063 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.194928885 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.194971085 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.194971085 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.195718050 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.195770979 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.195792913 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.195801020 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.195832968 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.195998907 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.197443962 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.197499990 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.197524071 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.197531939 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.197567940 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.197567940 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.198837042 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.198887110 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.198909044 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.198916912 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.198949099 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.198949099 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.221899986 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.221965075 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.221992016 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.222003937 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.222029924 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.222053051 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.223268032 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.223309994 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.223332882 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.223340988 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.223377943 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.223377943 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.224061012 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.224103928 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.224124908 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.224132061 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.224155903 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.224178076 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.238312006 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.238354921 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.238379002 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.238400936 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.238411903 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.238437891 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.303663015 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.303720951 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.303770065 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.303783894 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.303811073 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.303828955 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.304824114 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.304866076 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.304896116 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.304903984 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.304928064 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.304946899 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.306900978 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.306941986 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.306966066 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.306972980 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.307012081 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.307012081 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.307722092 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.307763100 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.307787895 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.307796001 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.307830095 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.307830095 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.328187943 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.328229904 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.328274965 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.328283072 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.328320980 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.328321934 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.329384089 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.329432011 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.329452038 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.329474926 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.329497099 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.329497099 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.329518080 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.332163095 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.332202911 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.332231045 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.332238913 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.332266092 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.332283974 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.335251093 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.335294962 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.335320950 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.335329056 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.335354090 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.335380077 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.394290924 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.394340038 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.394423008 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.394484043 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.394501925 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.394526958 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.398659945 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.398719072 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.398751020 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.398758888 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.398799896 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.398799896 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.400213957 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.400258064 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.400289059 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.400296926 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.400316954 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.400336981 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.400355101 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.400403976 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.400418997 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.400428057 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.400455952 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.400474072 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.427527905 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.427563906 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.427608013 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.427619934 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.427647114 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.427673101 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.428522110 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.428548098 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.428586006 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.428596020 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.428632021 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.428632021 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.428841114 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.428864002 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.428899050 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.428906918 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.428926945 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.428945065 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.432332993 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.432353973 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.432393074 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.432415009 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.432425976 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.432449102 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.491843939 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.491867065 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.491955042 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.492010117 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.492060900 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.493880033 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.493901014 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.493964911 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.493974924 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.494018078 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.494874954 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.494895935 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.494932890 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.494941950 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.494977951 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.495002031 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.497236967 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.497257948 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.497308016 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.497338057 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.497360945 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.497370958 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.521287918 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.521306992 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.521364927 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.521374941 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.521411896 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.522473097 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.522492886 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.522536993 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.522545099 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.522563934 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.522579908 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.524333954 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.524353027 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.524403095 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.524410963 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.524450064 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.525551081 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.525572062 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.525613070 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.525620937 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.525639057 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.525650978 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.583204985 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.583236933 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.583297014 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.583323956 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.583349943 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.583358049 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.589485884 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.589505911 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.589548111 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.589555979 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.589574099 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.589590073 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.590138912 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.590158939 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.590200901 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.590209007 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.590224981 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.590239048 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.590857983 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.590878010 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.590928078 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.590935946 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.590965986 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.625351906 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.625375032 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.625442982 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.625451088 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.625587940 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.626789093 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.626808882 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.626852036 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.626858950 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.626888990 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.627072096 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.627698898 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.627718925 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.627756119 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.627768993 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.627784967 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.627804041 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.630327940 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.630350113 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.630389929 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.630397081 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.630414963 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.630456924 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.677170038 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.677192926 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.677288055 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.677314997 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.677360058 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.687608957 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.687629938 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.687681913 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.687690020 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.687741041 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.688689947 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.688710928 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.688743114 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.688750982 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.688785076 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.688785076 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.690110922 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.690130949 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.690165997 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.690172911 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.690192938 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.690207958 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.722374916 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.722395897 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.722489119 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.722522020 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.722534895 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.722558975 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.724025011 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.724047899 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.724083900 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.724092007 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.724123001 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.724137068 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.724749088 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.724770069 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.724823952 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.724832058 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.724869013 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.725969076 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.725996017 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.726046085 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.726053953 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.726093054 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.790853977 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.790875912 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.790971994 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.790991068 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.791033030 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.791708946 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.791728973 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.791769028 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.791776896 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.791816950 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.791816950 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.793529034 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.793548107 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.793581009 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.793587923 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.793611050 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.793623924 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.794655085 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.794673920 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.794703960 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.794709921 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.794730902 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.794744968 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.815026045 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.815047026 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.815119028 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.815130949 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.815169096 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.816171885 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.816191912 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.816241026 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.816248894 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.816283941 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.818207026 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.818228960 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.818267107 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.818274021 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.818296909 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.818325996 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.819031000 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.819051981 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.819098949 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.819107056 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.819142103 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.886615038 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.886637926 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.886717081 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.886729956 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.886770010 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.889276028 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.889319897 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.889350891 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.889358997 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.889388084 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.889404058 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.889962912 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.889981985 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.890013933 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.890021086 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.890044928 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.890064955 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.891767979 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.891787052 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.891848087 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.891855001 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.891865969 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.891891956 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.923980951 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.924006939 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.924052954 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.924079895 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.924093008 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.924119949 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.927182913 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.927202940 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.927242994 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.927249908 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.927275896 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.927290916 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.927294970 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.927314997 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.927340984 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.927346945 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.927356958 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.927380085 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.927398920 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.929828882 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.929848909 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.929900885 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.929909945 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.929949999 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.979985952 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.980007887 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.980078936 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.980092049 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.980103970 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.980128050 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.985850096 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.985872030 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.985914946 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.985920906 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.985966921 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.986193895 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.986216068 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.986247063 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.986253023 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.986267090 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.986287117 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.987766981 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.987787962 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.987821102 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.987827063 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:36.987850904 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:36.987864017 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.334541082 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.334580898 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.334747076 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.334769964 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.334816933 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.335059881 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.335082054 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.335127115 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.335134029 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.335163116 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.335180044 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.337351084 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.337385893 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.337421894 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.337429047 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.337451935 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.337466002 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.338979959 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.338999987 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.339046955 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.339054108 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.339097023 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.339621067 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.339642048 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.339680910 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.339687109 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.339714050 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.339725971 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.341980934 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.342000008 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.342036009 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.342042923 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.342068911 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.342082977 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.344191074 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.344212055 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.344245911 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.344254017 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.344274998 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.344295025 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.346111059 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.346139908 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.346174955 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.346182108 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.346208096 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.346216917 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.357942104 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.357963085 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.358002901 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.358016014 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.358027935 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.358050108 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.358613968 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.358633041 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.358697891 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.358706951 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.358753920 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.360645056 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.360663891 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.360709906 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.360718012 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.360758066 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.366115093 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.366134882 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.366190910 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.366199017 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.366235018 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.367522001 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.367544889 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.367577076 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.367583990 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.367609024 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.367621899 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.369642019 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.369663000 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.369710922 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.369719028 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.369752884 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.371011019 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.371031046 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.371068001 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.371074915 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.371093035 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.371113062 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.371998072 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.372025013 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.372064114 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.372071981 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.372093916 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.372109890 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.380384922 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.380404949 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.380443096 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.380450964 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.380467892 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.380490065 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.381067038 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.381088018 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.381123066 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.381129026 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.381153107 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.381165028 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.381733894 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.381753922 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.381799936 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.381807089 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.381844997 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.382649899 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.382671118 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.382707119 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.382714033 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.382735014 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.382752895 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.388695002 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.388715982 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.388752937 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.388760090 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.388780117 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.388799906 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.389763117 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.389784098 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.389816999 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.389822960 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.389838934 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.389858961 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.389904976 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.389925003 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.389956951 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.389962912 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.389998913 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.390057087 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.390080929 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.390099049 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.390099049 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.390105963 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.390130997 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.390153885 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.391194105 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.391213894 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.391252041 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.391258955 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.391278982 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.391294003 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.392294884 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.392313957 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.392354965 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.392363071 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.392391920 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.392405987 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.394057989 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.394078016 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.394112110 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.394120932 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.394149065 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.394166946 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.394890070 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.395008087 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.395028114 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.395067930 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.395075083 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.395123005 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.395123005 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.395365000 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.406219006 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.406239033 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.406308889 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.406322002 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.406368017 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.407341003 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.407361984 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.407394886 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.407402039 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.407429934 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.407444954 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.409188986 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.409230947 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.409276009 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.409284115 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.409318924 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.409337997 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.409986973 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.410016060 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.410051107 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.410057068 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.410099030 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.410099030 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.418454885 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.418478012 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.418553114 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.418562889 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.418602943 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.419409990 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.419430971 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.419470072 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.419477940 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.419503927 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.419517994 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.420293093 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.420312881 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.420350075 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.420356989 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.420377016 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.420397043 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.421011925 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.421031952 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.421067953 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.421075106 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.421098948 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.421114922 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.448906898 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.448937893 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.448985100 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.448998928 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.449026108 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.449048042 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.449742079 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.449762106 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.449800968 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.449806929 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.449832916 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.449845076 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.451431036 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.451457024 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.451500893 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.451508045 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.451517105 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.451544046 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.454705954 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.454732895 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.454773903 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.454782009 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.454802990 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.454818010 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.491092920 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.491115093 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.491172075 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.491184950 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.491202116 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.491223097 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.496969938 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.496990919 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.497092962 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.497111082 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.497157097 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.498003006 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.498030901 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.498070955 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.498079062 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.498104095 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.498123884 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.500607967 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.500636101 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.500665903 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.500674009 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.500708103 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.502497911 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.544559002 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.544590950 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.544625044 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.544636011 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.544651985 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.544677973 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.545217991 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.545248985 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.545285940 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.545291901 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.545360088 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.546286106 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.546487093 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.546508074 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.546546936 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.546559095 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.546581984 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.546596050 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.551594019 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.551625013 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.551656961 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.551665068 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.551691055 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.551702976 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.590111971 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.590156078 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.590188026 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.590204954 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.590229988 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.590248108 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.592659950 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.592705965 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.592721939 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.592729092 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.592756033 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.592771053 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.593561888 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.593588114 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.593611002 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.593617916 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.593646049 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.593658924 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.599261045 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.599281073 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.599320889 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.599328995 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.599363089 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.599378109 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.637892008 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.637917995 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.638058901 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.638084888 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.638138056 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.639416933 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.639436960 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.639503956 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.639513016 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.639552116 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.642900944 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.642920971 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.642951012 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.642966986 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.642980099 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.642996073 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.646364927 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.646385908 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.646419048 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.646434069 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.646459103 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.646476984 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.701669931 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.701695919 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.701792955 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.701833963 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.701883078 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.704330921 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.704350948 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.704402924 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.704411030 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.704437017 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.704452038 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.706095934 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.706115961 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.706162930 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.706171036 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.706207991 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.709907055 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.709927082 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.710006952 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.710015059 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.710052013 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.737608910 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.737638950 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.737801075 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.737801075 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.737813950 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.737850904 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.738539934 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.738560915 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.738591909 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.738599062 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.738622904 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.738641977 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.741523027 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.741544008 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.741581917 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.741592884 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.741621017 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.741633892 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.743510962 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.743530035 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.743556976 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.743565083 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.743586063 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.743602991 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.823189020 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.823211908 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.823450089 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.823487997 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.823538065 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.825433016 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.825453043 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.825500965 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.825510979 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.825537920 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.825556993 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.826522112 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.826543093 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.826586008 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.826594114 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.826618910 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.826632977 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.828598022 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.828617096 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.828664064 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.828674078 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.828706026 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.828720093 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.839808941 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.839828014 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.839859009 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.839869022 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.839888096 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.839910984 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.840718031 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.842924118 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.842942953 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.842991114 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.842998028 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.843030930 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.843050957 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.844315052 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.844335079 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.844377041 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.844384909 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.844407082 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.844427109 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.845180988 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.845206976 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.845236063 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.845242977 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.845267057 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.845304966 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.905066967 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.905088902 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.905235052 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.905235052 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.905252934 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.905292988 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.906578064 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.906598091 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.906632900 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.906640053 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.906666994 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.906686068 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.907810926 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.907831907 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.907865047 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.907871962 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.907896042 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.907915115 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.909609079 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.909638882 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.909673929 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.909681082 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.909703970 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.909722090 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.930100918 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.930124044 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.930171967 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.930182934 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.930217028 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.930233955 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.931143045 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.931164026 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.931211948 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.931219101 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.931243896 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.931263924 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.933012962 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.933033943 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.933070898 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.933079004 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.933104038 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.933130980 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.934923887 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.934947014 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.934986115 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.934993029 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:37.935018063 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:37.935030937 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.001194954 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.001219034 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.001277924 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.001286030 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.001318932 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.001333952 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.002008915 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.002029896 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.002075911 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.002083063 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.002096891 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.002115011 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.007169962 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.007190943 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.007246017 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.007255077 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.007294893 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.007994890 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.008013964 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.008045912 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.008053064 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.008078098 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.008090973 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.027585983 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.027607918 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.027674913 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.027683020 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.027729988 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.030169010 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.030191898 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.030275106 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.030282974 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.030330896 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.031322002 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.031342030 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.031383991 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.031389952 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.031420946 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.031435013 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.032664061 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.032685995 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.032751083 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.032758951 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.032824039 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.096951962 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.096993923 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.097098112 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.097166061 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.097208977 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.097230911 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.098516941 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.098537922 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.098602057 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.098618031 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.098649979 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.098669052 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.099841118 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.099869013 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.099912882 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.099920034 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.099950075 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.099970102 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.101356983 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.101378918 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.101422071 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.101429939 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.101459026 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.101478100 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.132517099 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.132544994 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.132626057 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.132638931 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.132683039 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.134124041 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.134145975 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.134188890 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.134196043 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.134219885 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.134238958 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.136296034 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.136317015 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.136363983 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.136372089 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.136411905 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.138214111 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.138237000 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.138273001 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.138279915 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.138298988 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.138319969 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.212622881 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.212646961 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.212838888 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.212852001 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.212963104 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.214137077 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.214158058 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.214271069 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.214277983 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.214365959 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.216955900 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.216985941 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.217036009 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.217042923 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.217055082 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.217073917 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.220895052 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.220918894 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.220966101 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.220973969 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.221014977 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.254265070 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.254297018 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.254378080 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.254395008 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.254432917 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.255979061 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.256000996 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.256055117 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.256062031 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.256098032 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.258400917 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.258421898 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.258462906 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.258470058 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.258491039 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.258505106 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.258666039 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.258708000 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.258727074 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.258733034 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.258759022 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.258770943 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.331317902 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.331346035 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.331449986 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.331465006 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.331511021 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.334718943 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.334752083 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.334806919 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.334816933 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.334856987 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.336332083 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.336352110 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.336400032 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.336406946 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.336419106 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.336441994 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.338570118 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.338592052 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.338645935 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.338654041 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.338704109 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.373289108 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.373311996 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.373430967 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.373456001 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.373498917 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.377540112 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.377563000 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.377605915 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.377614021 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.377640009 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.377660036 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.381422997 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.381445885 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.381484985 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.381491899 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.381508112 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.381527901 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.384681940 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.384713888 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.384768009 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.384774923 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.384808064 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.451127052 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.451169968 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.451342106 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.451385975 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.451430082 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.456916094 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.456954002 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.457019091 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.457027912 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.457066059 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.459912062 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.459939003 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.459980965 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.459989071 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.460150957 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.460150957 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.461792946 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.461817026 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.461859941 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.461868048 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.461884022 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.461900949 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.495703936 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.495733976 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.495876074 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.495876074 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.495906115 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.495956898 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.499205112 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.499234915 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.499291897 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.499300957 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.499341011 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.507903099 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.507931948 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.507975101 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.507982016 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.508002043 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.508012056 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.529685974 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.529710054 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.529901028 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.529946089 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.530014038 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.585297108 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.585336924 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.585506916 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.585506916 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.585536003 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.585585117 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.594255924 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.594274998 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.594342947 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.594352961 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.594362020 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.594398022 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.622832060 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.622850895 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.622946024 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.622967958 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.623009920 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.630228996 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.630247116 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.630320072 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.630347967 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.630386114 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.666877031 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.666897058 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.666982889 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.667016983 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.667062998 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.670855045 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.670871973 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.670963049 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.670993090 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.671044111 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.679961920 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.679977894 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.680036068 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.680046082 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.680082083 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.691241026 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.691257954 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.691328049 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.691338062 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.691378117 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.706794977 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.706809998 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.706888914 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.706898928 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.706937075 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.710786104 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.710799932 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.710850954 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.710860014 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.710895061 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.710895061 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.720901966 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.720942020 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.721038103 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.721055031 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.721115112 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.759846926 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.759866953 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.760170937 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.760207891 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.760284901 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.764635086 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.764648914 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.764734030 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.764749050 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.764791965 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.770174980 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.770189047 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.770308971 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.770322084 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.770361900 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.773243904 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.773257017 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.773332119 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.773341894 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.773382902 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.787203074 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.787240982 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.787378073 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.787396908 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.787446022 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.802031040 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.802047968 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.802119970 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.802144051 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.802197933 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.805387020 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.805401087 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.805469990 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.805479050 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.805526018 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.809735060 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.809750080 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.809815884 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.809828043 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.809870958 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.845094919 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.845127106 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.845225096 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.845238924 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.845285892 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.849487066 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.849509954 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.849632978 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.849643946 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.849693060 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.853442907 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.853465080 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.853549004 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.853559971 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.853606939 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.856359959 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.856383085 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.856498003 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.856507063 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.856576920 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.884046078 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.884094000 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.884176970 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.884190083 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.884234905 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.896332026 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.896359921 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.896471977 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.896492958 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.896552086 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.902774096 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.902797937 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.902879000 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.902893066 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.902941942 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.905937910 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.905958891 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.906025887 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.906039000 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.906094074 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.942606926 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.942636967 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.942744017 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.942789078 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.942831993 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.944608927 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.944633961 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.944727898 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.944767952 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.944838047 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.947304964 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.947330952 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.947402954 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.947422981 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.947462082 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.950210094 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.950269938 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.950318098 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.950326920 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.950370073 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.950370073 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.978049994 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.978100061 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.978282928 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.978282928 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.978319883 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.978416920 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.993709087 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.993801117 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.993807077 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.993830919 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.993885040 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.993885040 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.995599031 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.995641947 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.995671988 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.995681047 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.995708942 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.995738983 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.998142004 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.998187065 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.998220921 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.998229027 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:38.998254061 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:38.998285055 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.019840002 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.019887924 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.019936085 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.019943953 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.019968033 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.019988060 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.021759987 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.021801949 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.021878958 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.021879911 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.021917105 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.021962881 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.023516893 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.023559093 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.023591995 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.023601055 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.023643970 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.023643970 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.025361061 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.025438070 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.025439024 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.025465012 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.025497913 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.025521040 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.075819016 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.075861931 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.075900078 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.075951099 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.075967073 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.075997114 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.089826107 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.089868069 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.090049982 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.090049982 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.090070963 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.090115070 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.091815948 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.091869116 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.091943026 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.091943026 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.091979980 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.092032909 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.094279051 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.094324112 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.094353914 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.094362974 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.094388962 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.094408989 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.110059977 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.110104084 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.110236883 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.110236883 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.110263109 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.110311031 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.111083984 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.111129999 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.111167908 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.111176014 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.111186028 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.111208916 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.115294933 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.115350962 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.115397930 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.115412951 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.115423918 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.115448952 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.117165089 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.117213964 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.117257118 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.117265940 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.117279053 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.117307901 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.168376923 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.168426037 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.168493986 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.168536901 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.168555021 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.168580055 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.181092024 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.181133986 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.181217909 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.181217909 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.181252003 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.181289911 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.182651997 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.182693958 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.182729006 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.182775021 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.182811022 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.182826042 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.185179949 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.185225010 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.185261965 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.185288906 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.185302019 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.185327053 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.203567982 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.203610897 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.203927994 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.203974009 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.204030991 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.206033945 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.206079006 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.206113100 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.206140041 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.206155062 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.206182003 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.211507082 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.211549997 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.211592913 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.211620092 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.211635113 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.211664915 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.212402105 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.212470055 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.212476969 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.212517023 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.212557077 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.212570906 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.271389961 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.271445036 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.271496058 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.271522999 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.271538019 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.271564007 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.286055088 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.286099911 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.286164999 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.286164999 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.286190033 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.286228895 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.287189960 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.287234068 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.287264109 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.287271023 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.287293911 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.287307024 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.291590929 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.291634083 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.291675091 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.291692972 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.291704893 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.291728020 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.306807995 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.306854963 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.306901932 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.306929111 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.306946039 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.306972980 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.307534933 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.307593107 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.307614088 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.307622910 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.307642937 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.307661057 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.308784008 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.308852911 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.308862925 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.308891058 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.308921099 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.308933020 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.310712099 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.310755968 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.310781956 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.310792923 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.310813904 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.310827017 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.368011951 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.368077993 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.368114948 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.368144035 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.368160009 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.368180037 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.390868902 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.390921116 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.391091108 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.391114950 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.391161919 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.393181086 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.393224955 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.393259048 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.393266916 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.393292904 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.393302917 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.394218922 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.394269943 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.394294024 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.394300938 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.394324064 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.394339085 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.409364939 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.409410000 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.409444094 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.409476042 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.409491062 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.409513950 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.410286903 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.410330057 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.410356045 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.410366058 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.410389900 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.410399914 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.413593054 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.413641930 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.413669109 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.413676023 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.413700104 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.413710117 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.418973923 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.419024944 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.419059992 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.419087887 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.419102907 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.419122934 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.463996887 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.464067936 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.464155912 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.464201927 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.464217901 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.464246988 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.484608889 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.484678984 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.484725952 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.484750032 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.484769106 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.484791994 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.485487938 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.485537052 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.485562086 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.485569954 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.485594034 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.485609055 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.486830950 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.486875057 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.486897945 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.486905098 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.486926079 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.486943007 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.500852108 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.500910044 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.500946999 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.500971079 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.500984907 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.501013994 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.501698971 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.501750946 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.501775980 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.501784086 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.501802921 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.501818895 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.502564907 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.502619028 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.502641916 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.502648115 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.502672911 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.502685070 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.504838943 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.504882097 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.504906893 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.504913092 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.504941940 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.504951954 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.556560040 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.556627989 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.556799889 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.556838989 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.556886911 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.577851057 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.577914000 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.577955008 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.577987909 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.578002930 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.578028917 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.578968048 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.579020023 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.579081059 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.579107046 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.579160929 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.579160929 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.579802036 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.579853058 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.579881907 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.579919100 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.579935074 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.579986095 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.594815969 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.594861031 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.594904900 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.594921112 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.594937086 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.595046043 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.596410990 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.596462011 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.596508026 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.596533060 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.596544027 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.596580029 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.599849939 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.599898100 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.599926949 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.599936008 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.599961996 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.599973917 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.602334976 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.602380037 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.602410078 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.602416992 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.602432966 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.602451086 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.651890039 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.651959896 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.652019978 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.652031898 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.652065039 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.652085066 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.670983076 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.671051979 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.671093941 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.671102047 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.671129942 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.671144009 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.672254086 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.672297955 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.672328949 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.672337055 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.672355890 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.672369957 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.674370050 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.674428940 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.674454927 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.674463034 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.674487114 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.674511909 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.688273907 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.688321114 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.688353062 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.688360929 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.688384056 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.688404083 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.689769030 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.689820051 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.689857006 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.689865112 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.689891100 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.689901114 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.693661928 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.693703890 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.693754911 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.693768978 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.693779945 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.693804979 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.696250916 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.696300030 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.696331024 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.696338892 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.696352005 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.696371078 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.744782925 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.744864941 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.744890928 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.744899035 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.744914055 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.744927883 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.744937897 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.782625914 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.782685995 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.782743931 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.782761097 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.782772064 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.782830954 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.782839060 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.782870054 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.782903910 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.782912016 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.782923937 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.782949924 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.785176992 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.785238981 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.785270929 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.785300016 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.785325050 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.785339117 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.786511898 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.786577940 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.786601067 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.786608934 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.786633968 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.786649942 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.788158894 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.788206100 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.788229942 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.788238049 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.788252115 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.788280010 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.791241884 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.791264057 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.791305065 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.791313887 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.791332960 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.791359901 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.792884111 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.792912960 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.792946100 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.792953014 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.792968035 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.792989016 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.838190079 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.838243961 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.838345051 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.838356972 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.838398933 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.838407040 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.875978947 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.876024961 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.876072884 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.876081944 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.876110077 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.876127005 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.876955032 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.876990080 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.877038002 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.877047062 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.877073050 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.877093077 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.878721952 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.878766060 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.878796101 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.878802061 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.878832102 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.878844023 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.880064011 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.880098104 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.880135059 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.880141973 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.880165100 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.880194902 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.881412983 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.881436110 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.881477118 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.881483078 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.881498098 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.881520987 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.882324934 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.882356882 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.882390022 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.882396936 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.882425070 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.882425070 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.884151936 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.884201050 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.884221077 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.884228945 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.884252071 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.884298086 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.932128906 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.932168961 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.932249069 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.932281971 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.932296038 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.932338953 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.968420029 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.968451023 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.968508005 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.968525887 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.968538046 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.968569040 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.969743013 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.969764948 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.969809055 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.969820976 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.969834089 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.969863892 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.970710039 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.970731974 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.970782995 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.970792055 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.970803976 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.970825911 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.971744061 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.971762896 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.971798897 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.971807003 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.971822023 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.971834898 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.972691059 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.972711086 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.972745895 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.972754002 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.972774029 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.972790956 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.974967003 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.974988937 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.975028038 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.975037098 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.975049019 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.975074053 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.976749897 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.976768970 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.976804972 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.976814032 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:39.976826906 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:39.976850986 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.025939941 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.025963068 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.026158094 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.026196957 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.026247978 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.062829018 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.062856913 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.062966108 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.062984943 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.063040018 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.063986063 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.064006090 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.064059973 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.064069033 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.064093113 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.064106941 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.064845085 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.064865112 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.064908981 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.064918995 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.064946890 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.064965010 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.065694094 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.065715075 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.065757036 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.065764904 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.065804958 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.065814972 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.067464113 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.067485094 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.067523956 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.067533016 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.067563057 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.067563057 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.068727970 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.068754911 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.068792105 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.068799973 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.068828106 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.068837881 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.069422007 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.069443941 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.069477081 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.069483995 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.069504023 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.069534063 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.119863987 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.119884968 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.120055914 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.120099068 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.120151043 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.156205893 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.156241894 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.156455994 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.156502962 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.156553984 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.157228947 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.157255888 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.157290936 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.157299995 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.157326937 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.157339096 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.158519983 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.158540964 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.158586025 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.158593893 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.158638954 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.158664942 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.159594059 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.159615040 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.159655094 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.159663916 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.159688950 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.159702063 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.160665989 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.160703897 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.160741091 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.160751104 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.160775900 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.160785913 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.163589954 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.163611889 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.163651943 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.163660049 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.163688898 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.163700104 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.163917065 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.163938046 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.163966894 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.163974047 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.163995028 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.164004087 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.167417049 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.213486910 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.213516951 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.213577032 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.213610888 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.213654041 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.213684082 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.252091885 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.252126932 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.252285957 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.252285957 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.252325058 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.252373934 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.253458977 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.253490925 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.253531933 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.253541946 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.253556013 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.253582001 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.254394054 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.254431963 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.254451036 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.254458904 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.254477978 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.254488945 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.256674051 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.256696939 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.256730080 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.256737947 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.256757021 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.256767035 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.258136034 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.258158922 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.258189917 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.258197069 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.258210897 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.258234978 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.260066032 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.260087013 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.260138988 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.260148048 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.260186911 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.263248920 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.263271093 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.263309002 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.263318062 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.263330936 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.263356924 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.313437939 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.313460112 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.313659906 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.313698053 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.313745975 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.348400116 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.348428965 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.348701000 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.348782063 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.348854065 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.349703074 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.349725008 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.349770069 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.349780083 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.349796057 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.349821091 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.352272987 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.352293968 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.352334023 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.352341890 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.352354050 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.352372885 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.353462934 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.353487015 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.353523016 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.353530884 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.353544950 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.353568077 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.355645895 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.355667114 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.355717897 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.355726957 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.355763912 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.357215881 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.357235909 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.357291937 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.357299089 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.357311010 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.357335091 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.360001087 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.360029936 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.360064983 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.360074043 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.360086918 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.360106945 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.413399935 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.413429022 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.413474083 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.413499117 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.413515091 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.413541079 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.455137014 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.455178022 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.455238104 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.455249071 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.455279112 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.455290079 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.456228018 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.456249952 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.456293106 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.456301928 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.456327915 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.456346989 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.457521915 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.457545042 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.457586050 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.457593918 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.457612991 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.457632065 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.461741924 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.461771011 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.461812019 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.461827993 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.461844921 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.461863041 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.463541985 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.463562965 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.463598967 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.463607073 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.463619947 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.463640928 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.465495110 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.465516090 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.465553045 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.465562105 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.465574980 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.465596914 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.469166994 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.469194889 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.469274998 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.469285011 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.469332933 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.532561064 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.532584906 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.532681942 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.532699108 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.532743931 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.557379007 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.557400942 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.557459116 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.557470083 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.557485104 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.557507038 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.559072971 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.559094906 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.559144020 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.559154034 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.559190035 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.559612036 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.559636116 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.559688091 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.559696913 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.559731007 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.562592030 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.562613964 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.562661886 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.562670946 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.562706947 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.564603090 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.564624071 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.564662933 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.564671993 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.564685106 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.564708948 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.567409992 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.567436934 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.567473888 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.567483902 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.567497969 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.567521095 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.570247889 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.570269108 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.570323944 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.570336103 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.570370913 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.646316051 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.646348953 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.646388054 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.646403074 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.646425009 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.646439075 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.662153959 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.662190914 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.662239075 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.662249088 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.662267923 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.662278891 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.664146900 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.664169073 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.664220095 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.664228916 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.664266109 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.666831970 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.666853905 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.666908026 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.666918993 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.666959047 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.668356895 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.668384075 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.668435097 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.668445110 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.668486118 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.669951916 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.669979095 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.670018911 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.670027971 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.670041084 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.670064926 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.672606945 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.672629118 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.672667980 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.672676086 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.672688007 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.672719002 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.675713062 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.675734043 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.675777912 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.675786972 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.675800085 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.675823927 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.734220028 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.734258890 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.734357119 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.734369040 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.734414101 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.810910940 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.810951948 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.811016083 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.811034918 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.811065912 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.811080933 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.813129902 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.813163042 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.813205004 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.813214064 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.813236952 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.813255072 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.815814018 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.815836906 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.815886974 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.815898895 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.815937996 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.818196058 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.818217993 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.818259001 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.818268061 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.818291903 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.818310976 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.820656061 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.820687056 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.820720911 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.820729971 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.820758104 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.820768118 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.824397087 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.824419975 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.824477911 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.824492931 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.824511051 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.824528933 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.825980902 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.826009989 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.826056957 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.826066017 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.826095104 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.826112032 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.845916986 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.845947027 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.845995903 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.846009970 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.846040964 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.846065998 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.858405113 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.858433008 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.858515024 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.858524084 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.858568907 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.860311985 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.860333920 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.860389948 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.860399008 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.860438108 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.863765955 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.863787889 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.863826036 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.863833904 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.863854885 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.863864899 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.865394115 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.865421057 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.865462065 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.865469933 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.865489006 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.865504980 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.867343903 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.867367029 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.867414951 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.867424011 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.867461920 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.868918896 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.868942022 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.868978024 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.868985891 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.869010925 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.869034052 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.901505947 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.901535988 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.901570082 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.901582003 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.901609898 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.901628017 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.921865940 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.921895981 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.921983957 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.922027111 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.922086954 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.951330900 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.951360941 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.951394081 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.951402903 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.951478004 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.951478004 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.952944040 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.952972889 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.953005075 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.953012943 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.953039885 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.953078032 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.954713106 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.954735994 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.954751015 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.954773903 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.954780102 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.954790115 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.954811096 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.956640959 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.956671000 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.956722975 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.956729889 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.956758022 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.956775904 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.958301067 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.958324909 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.958360910 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.958367109 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.958384991 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.958394051 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.960131884 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.960160017 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.960199118 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.960206985 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.960216999 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.960246086 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.997317076 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.997348070 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.997402906 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.997411966 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:40.997428894 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:40.997448921 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.023240089 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.023269892 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.023380995 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.023403883 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.023443937 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.049024105 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.049055099 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.049101114 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.049117088 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.049143076 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.049161911 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.051354885 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.051383018 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.051426888 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.051434994 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.051459074 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.051470041 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.052119017 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.052140951 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.052185059 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.052192926 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.052212000 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.052232027 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.053977013 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.053999901 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.054035902 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.054043055 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.054061890 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.054080963 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.056029081 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.056054115 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.056091070 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.056097984 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.056118965 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.056133986 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.060518026 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.060545921 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.060600996 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.060611010 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.060647964 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.098521948 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.098562002 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.098623037 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.098634958 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.098659039 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.098674059 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.131886005 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.131917953 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.131994009 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.132003069 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.132044077 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.154275894 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.154306889 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.154381037 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.154392004 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.154426098 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.154437065 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.155944109 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.155966043 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.156162024 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.156169891 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.156210899 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.157080889 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.157114983 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.157166958 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.157175064 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.157212973 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.158258915 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.158281088 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.158323050 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.158330917 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.158358097 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.158375025 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.160275936 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.160296917 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.160346985 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.160356045 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.160391092 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.163582087 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.163604975 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.163644075 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.163656950 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.163669109 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.163686991 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.199219942 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.199254036 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.199310064 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.199328899 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.199353933 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.199373960 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.227286100 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.227317095 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.227380991 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.227420092 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.227438927 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.227462053 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.254864931 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.254895926 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.255043983 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.255043983 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.255057096 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.255101919 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.257653952 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.257684946 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.257733107 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.257741928 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.257781029 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.258852005 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.258877039 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.258915901 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.258924007 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.258936882 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.258953094 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.261717081 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.261743069 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.261778116 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.261786938 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.261801004 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.261823893 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.263000965 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.263021946 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.263062000 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.263070107 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.263082981 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.263103008 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.274601936 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.274632931 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.274677992 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.274684906 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.274852991 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.274852991 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.295874119 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.295912027 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.296052933 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.296052933 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.296062946 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.296128035 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.336832047 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.336862087 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.336977005 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.337004900 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.337050915 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.374814987 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.374846935 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.374952078 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.374972105 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.375041008 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.379168987 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.379251957 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.379272938 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.379285097 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.379302979 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.379322052 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.383721113 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.383759022 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.383801937 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.383811951 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.383826017 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.383843899 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.387310028 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.387347937 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.387398005 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.387403965 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.387418985 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.387435913 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.391669989 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.391699076 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.391733885 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.391742945 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.391758919 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.391768932 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.404675007 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.404710054 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.404757977 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.404778004 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.404795885 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.404810905 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.415158987 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.415194035 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.415234089 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.415241957 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.415257931 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.415271997 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.440118074 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.440151930 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.440207005 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.440217018 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.440253973 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.472290993 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.472321987 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.472382069 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.472392082 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.472405910 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.472425938 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.476130009 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.476167917 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.476195097 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.476202011 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.476217985 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.476236105 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.480442047 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.480477095 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.480515003 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.480524063 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.480539083 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.480556965 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.482996941 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.483025074 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.483066082 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.483074903 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.483088017 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.483110905 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.487320900 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.487344027 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.487396002 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.487404108 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.487438917 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.504468918 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.504508972 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.504560947 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.504570007 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.504601955 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.504615068 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.510780096 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.510807037 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.510848999 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.510858059 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.510874033 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.510890961 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.545577049 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.545598984 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.545775890 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.545809031 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.545855045 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.567648888 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.567691088 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.567768097 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.567787886 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.567828894 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.571120977 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.571140051 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.571204901 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.571214914 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.571253061 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.573062897 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.573082924 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.573134899 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.573147058 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.573184013 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.576983929 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.577006102 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.577054024 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.577063084 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.577099085 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.581232071 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.581254959 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.581335068 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.581345081 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.581386089 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.598196983 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.598217010 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.598378897 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.598390102 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.598431110 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.605597019 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.605618954 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.605675936 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.605684996 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.605720997 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.640794039 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.640847921 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.640881062 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.640899897 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.640918970 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.640929937 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.679353952 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.679399014 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.679480076 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.679497004 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.679514885 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.679579973 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.684365988 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.684406996 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.684437990 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.684447050 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.684464931 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.684484959 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.688548088 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.688591003 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.688620090 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.688627958 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.688643932 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.688654900 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.697494984 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.697535992 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.697573900 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.697582006 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.697597980 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.697613955 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.698795080 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.698837042 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.698869944 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.698879957 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.698896885 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.698911905 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.706223965 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.706269979 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.706309080 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.706321955 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.706340075 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.706355095 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.709711075 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.709753990 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.709784985 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.709796906 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.709810972 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.709830999 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.732650995 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.732712030 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.732759953 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.732770920 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.732799053 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.732808113 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.786367893 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.786465883 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.786488056 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.786544085 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.786592960 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.789434910 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.789458036 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:41.789472103 CEST49739443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:41.789494991 CEST4434973913.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:42.481825113 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:42.481925011 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:42.482033014 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:42.482407093 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:42.482443094 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.256017923 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.256117105 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.259819031 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.259850025 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.260143995 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.282583952 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.328495026 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.544231892 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.559166908 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.559226990 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.559266090 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.559326887 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.559362888 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.559391975 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.641767979 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.641789913 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.641896963 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.641968012 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.642127991 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.646635056 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.646650076 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.646712065 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.646727085 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.646759033 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.646781921 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.735169888 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.735208035 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.735389948 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.735389948 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.735457897 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.737891912 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.737906933 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.737970114 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.737987995 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.742777109 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.742789030 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.742852926 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.742870092 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.745410919 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.745429039 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.745469093 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.745490074 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.745515108 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.798499107 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.822069883 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.822114944 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.822202921 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.822202921 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.822276115 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.823482990 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.823503971 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.823559046 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.823585987 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.823612928 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.826267958 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.826282024 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.826344967 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.826365948 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.828406096 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.828418016 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.828471899 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.828504086 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.833256006 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.833270073 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.833334923 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.833349943 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.835227966 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.835239887 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.835298061 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.835311890 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.838120937 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.838134050 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.838157892 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.838190079 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.838208914 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.838264942 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.917949915 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.917967081 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.918076992 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.918107986 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.918226004 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.919966936 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.919981003 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.920052052 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.920066118 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.920128107 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.921996117 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.922012091 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.922106028 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.922118902 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.922203064 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.922420025 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.922434092 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.922507048 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.922518969 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.922590971 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.925394058 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.925409079 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.925452948 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.925466061 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.925498962 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.925519943 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.927093029 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.927109003 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.927159071 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.927171946 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.927222967 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.928004026 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.928065062 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.928078890 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.931145906 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.931159019 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.931224108 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:43.931237936 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:43.986002922 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:44.012336016 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:44.012382984 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:44.012423038 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:44.012458086 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:44.012475014 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:44.012475014 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:44.012495041 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:44.014187098 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:44.014202118 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:44.014256954 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:44.014265060 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:44.014303923 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:44.016037941 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:44.016060114 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:44.016113043 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:44.016119957 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:44.016160965 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:44.019459963 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:44.019474983 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:44.019546032 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:44.019567013 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:44.019598961 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:44.019619942 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:44.021584034 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:44.021596909 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:44.021658897 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:44.021673918 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:44.021728039 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:44.022551060 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:44.022564888 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:44.022622108 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:44.022638083 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:44.022700071 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:44.024420023 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:44.024434090 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:44.024501085 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:44.024514914 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:44.024579048 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:44.026257992 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:44.026272058 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:44.026331902 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:44.026345968 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:44.026401043 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:44.105420113 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:44.105449915 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:44.105560064 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:44.105585098 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:44.105644941 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:44.107929945 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:44.107954025 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:44.108004093 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:44.108017921 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:44.108051062 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:44.108074903 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:44.108566999 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:44.108613014 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:44.108639002 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:44.108656883 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:44.108679056 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:44.108680010 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:44.108731031 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:44.108797073 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:44.108834028 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:44.108860016 CEST49745443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:44.108877897 CEST4434974513.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:44.132654905 CEST49746443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:44.132707119 CEST4434974613.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:44.132791996 CEST49746443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:44.133034945 CEST49746443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:44.133065939 CEST4434974613.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:44.943521976 CEST4434974613.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:44.943624020 CEST49746443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:44.945955992 CEST49746443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:44.945990086 CEST4434974613.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:44.946327925 CEST4434974613.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:44.981700897 CEST49746443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:45.028501987 CEST4434974613.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:45.848433018 CEST4434974613.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:45.848459005 CEST4434974613.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:45.848562002 CEST49746443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:45.848577023 CEST4434974613.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:45.848608017 CEST4434974613.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:45.848658085 CEST4434974613.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:45.848705053 CEST49746443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:45.848705053 CEST49746443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:45.848736048 CEST49746443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:45.889591932 CEST4434974613.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:45.889616966 CEST4434974613.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:45.889686108 CEST49746443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:45.889710903 CEST4434974613.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:45.889741898 CEST49746443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:45.889764071 CEST49746443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:45.904758930 CEST4434974613.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:45.904777050 CEST4434974613.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:45.904859066 CEST49746443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:45.904875040 CEST4434974613.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:45.904928923 CEST49746443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:45.970407963 CEST4434974613.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:45.970487118 CEST49746443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:46.000082016 CEST4434974613.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:46.000102997 CEST4434974613.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:46.000190973 CEST49746443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:46.000247002 CEST4434974613.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:46.000317097 CEST49746443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:46.014053106 CEST4434974613.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:46.014076948 CEST4434974613.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:46.014143944 CEST49746443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:46.014163971 CEST4434974613.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:46.014195919 CEST49746443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:46.014219999 CEST49746443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:46.028677940 CEST4434974613.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:46.028702021 CEST4434974613.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:46.028779984 CEST49746443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:46.028800011 CEST4434974613.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:46.028851986 CEST49746443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:46.037255049 CEST4434974613.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:46.037338018 CEST49746443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:46.037343979 CEST4434974613.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:46.037406921 CEST4434974613.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:46.037432909 CEST49746443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:46.037461042 CEST49746443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:46.087018013 CEST4434974613.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:46.087065935 CEST4434974613.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:46.087115049 CEST4434974613.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:46.087122917 CEST49746443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:46.087122917 CEST49746443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:46.087197065 CEST49746443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:46.087306976 CEST49746443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:46.087357044 CEST4434974613.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:46.087387085 CEST49746443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:46.087408066 CEST4434974613.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:54.036259890 CEST49747443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:38:54.036356926 CEST44349747161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:54.038448095 CEST49747443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:38:54.058126926 CEST49747443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:38:54.058240891 CEST44349747161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:54.092883110 CEST49747443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:38:56.545243025 CEST49748443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:56.545340061 CEST4434974813.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:56.545515060 CEST49748443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:56.545821905 CEST49748443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:56.545854092 CEST4434974813.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:57.297926903 CEST4434974813.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:57.298012972 CEST49748443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:57.299160957 CEST49748443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:57.299182892 CEST4434974813.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:57.299514055 CEST4434974813.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:57.300602913 CEST49748443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:57.300602913 CEST49748443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:57.300643921 CEST4434974813.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:57.817780972 CEST4434974813.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:57.817873955 CEST4434974813.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:57.817934036 CEST49748443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:57.818061113 CEST49748443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:57.818100929 CEST4434974813.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:38:57.818131924 CEST49748443192.168.2.413.249.12.125
                                                                                                                                                              Jul 18, 2024 21:38:57.818147898 CEST4434974813.249.12.125192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:05.927381039 CEST49750443192.168.2.4143.204.205.88
                                                                                                                                                              Jul 18, 2024 21:39:05.927413940 CEST44349750143.204.205.88192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:05.927499056 CEST49750443192.168.2.4143.204.205.88
                                                                                                                                                              Jul 18, 2024 21:39:05.927819967 CEST49750443192.168.2.4143.204.205.88
                                                                                                                                                              Jul 18, 2024 21:39:05.927835941 CEST44349750143.204.205.88192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:06.472007036 CEST49751443192.168.2.452.25.171.187
                                                                                                                                                              Jul 18, 2024 21:39:06.472058058 CEST4434975152.25.171.187192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:06.472141981 CEST49751443192.168.2.452.25.171.187
                                                                                                                                                              Jul 18, 2024 21:39:06.473238945 CEST49751443192.168.2.452.25.171.187
                                                                                                                                                              Jul 18, 2024 21:39:06.473253012 CEST4434975152.25.171.187192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:06.701225996 CEST44349750143.204.205.88192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:06.701585054 CEST49750443192.168.2.4143.204.205.88
                                                                                                                                                              Jul 18, 2024 21:39:06.702913046 CEST49750443192.168.2.4143.204.205.88
                                                                                                                                                              Jul 18, 2024 21:39:06.702943087 CEST44349750143.204.205.88192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:06.703455925 CEST44349750143.204.205.88192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:06.704732895 CEST49750443192.168.2.4143.204.205.88
                                                                                                                                                              Jul 18, 2024 21:39:06.704732895 CEST49750443192.168.2.4143.204.205.88
                                                                                                                                                              Jul 18, 2024 21:39:06.704757929 CEST44349750143.204.205.88192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:07.291330099 CEST44349750143.204.205.88192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:07.293536901 CEST44349750143.204.205.88192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:07.293665886 CEST49750443192.168.2.4143.204.205.88
                                                                                                                                                              Jul 18, 2024 21:39:07.293732882 CEST49750443192.168.2.4143.204.205.88
                                                                                                                                                              Jul 18, 2024 21:39:07.293756962 CEST44349750143.204.205.88192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:07.293771029 CEST49750443192.168.2.4143.204.205.88
                                                                                                                                                              Jul 18, 2024 21:39:07.293778896 CEST44349750143.204.205.88192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:07.402631044 CEST4434975152.25.171.187192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:07.402698040 CEST49751443192.168.2.452.25.171.187
                                                                                                                                                              Jul 18, 2024 21:39:07.411154985 CEST49751443192.168.2.452.25.171.187
                                                                                                                                                              Jul 18, 2024 21:39:07.411170006 CEST4434975152.25.171.187192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:07.411767006 CEST4434975152.25.171.187192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:07.455905914 CEST49751443192.168.2.452.25.171.187
                                                                                                                                                              Jul 18, 2024 21:39:07.491233110 CEST49751443192.168.2.452.25.171.187
                                                                                                                                                              Jul 18, 2024 21:39:07.491255045 CEST49751443192.168.2.452.25.171.187
                                                                                                                                                              Jul 18, 2024 21:39:07.491264105 CEST4434975152.25.171.187192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:07.798738956 CEST4434975152.25.171.187192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:07.799165010 CEST4434975152.25.171.187192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:07.799226999 CEST49751443192.168.2.452.25.171.187
                                                                                                                                                              Jul 18, 2024 21:39:07.801259041 CEST49751443192.168.2.452.25.171.187
                                                                                                                                                              Jul 18, 2024 21:39:07.801276922 CEST4434975152.25.171.187192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:07.813749075 CEST49752443192.168.2.452.25.171.187
                                                                                                                                                              Jul 18, 2024 21:39:07.813775063 CEST4434975252.25.171.187192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:07.813847065 CEST49752443192.168.2.452.25.171.187
                                                                                                                                                              Jul 18, 2024 21:39:07.814030886 CEST49752443192.168.2.452.25.171.187
                                                                                                                                                              Jul 18, 2024 21:39:07.814042091 CEST4434975252.25.171.187192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:07.850388050 CEST49753443192.168.2.4143.204.205.88
                                                                                                                                                              Jul 18, 2024 21:39:07.850438118 CEST44349753143.204.205.88192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:07.850568056 CEST49753443192.168.2.4143.204.205.88
                                                                                                                                                              Jul 18, 2024 21:39:07.850831985 CEST49753443192.168.2.4143.204.205.88
                                                                                                                                                              Jul 18, 2024 21:39:07.850852013 CEST44349753143.204.205.88192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:07.968667984 CEST4975580192.168.2.434.117.223.223
                                                                                                                                                              Jul 18, 2024 21:39:07.975050926 CEST804975534.117.223.223192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:07.975289106 CEST4975580192.168.2.434.117.223.223
                                                                                                                                                              Jul 18, 2024 21:39:07.975289106 CEST4975580192.168.2.434.117.223.223
                                                                                                                                                              Jul 18, 2024 21:39:07.975311995 CEST4975580192.168.2.434.117.223.223
                                                                                                                                                              Jul 18, 2024 21:39:07.981816053 CEST804975534.117.223.223192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:07.981851101 CEST804975534.117.223.223192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:08.450525045 CEST4434975252.25.171.187192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:08.462748051 CEST804975534.117.223.223192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:08.463989019 CEST49752443192.168.2.452.25.171.187
                                                                                                                                                              Jul 18, 2024 21:39:08.464011908 CEST4434975252.25.171.187192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:08.466952085 CEST49752443192.168.2.452.25.171.187
                                                                                                                                                              Jul 18, 2024 21:39:08.466959000 CEST4434975252.25.171.187192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:08.466983080 CEST49752443192.168.2.452.25.171.187
                                                                                                                                                              Jul 18, 2024 21:39:08.466990948 CEST4434975252.25.171.187192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:08.517323971 CEST4975580192.168.2.434.117.223.223
                                                                                                                                                              Jul 18, 2024 21:39:08.620354891 CEST44349753143.204.205.88192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:08.620414019 CEST49753443192.168.2.4143.204.205.88
                                                                                                                                                              Jul 18, 2024 21:39:08.621654034 CEST49753443192.168.2.4143.204.205.88
                                                                                                                                                              Jul 18, 2024 21:39:08.621665001 CEST44349753143.204.205.88192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:08.621997118 CEST44349753143.204.205.88192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:08.623203993 CEST49753443192.168.2.4143.204.205.88
                                                                                                                                                              Jul 18, 2024 21:39:08.623204947 CEST49753443192.168.2.4143.204.205.88
                                                                                                                                                              Jul 18, 2024 21:39:08.623240948 CEST44349753143.204.205.88192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:08.702939034 CEST4434975252.25.171.187192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:08.703016996 CEST4434975252.25.171.187192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:08.703068972 CEST49752443192.168.2.452.25.171.187
                                                                                                                                                              Jul 18, 2024 21:39:08.707536936 CEST49752443192.168.2.452.25.171.187
                                                                                                                                                              Jul 18, 2024 21:39:08.707561016 CEST4434975252.25.171.187192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:09.215323925 CEST44349753143.204.205.88192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:09.215446949 CEST44349753143.204.205.88192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:09.215590000 CEST49753443192.168.2.4143.204.205.88
                                                                                                                                                              Jul 18, 2024 21:39:09.215632915 CEST49753443192.168.2.4143.204.205.88
                                                                                                                                                              Jul 18, 2024 21:39:09.215632915 CEST49753443192.168.2.4143.204.205.88
                                                                                                                                                              Jul 18, 2024 21:39:09.215652943 CEST44349753143.204.205.88192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:09.215662956 CEST44349753143.204.205.88192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:10.390671968 CEST4975580192.168.2.434.117.223.223
                                                                                                                                                              Jul 18, 2024 21:39:10.390702963 CEST4975580192.168.2.434.117.223.223
                                                                                                                                                              Jul 18, 2024 21:39:10.403007030 CEST804975534.117.223.223192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:10.403036118 CEST804975534.117.223.223192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:10.515490055 CEST804975534.117.223.223192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:10.564145088 CEST4975580192.168.2.434.117.223.223
                                                                                                                                                              Jul 18, 2024 21:39:11.018959045 CEST49760443192.168.2.434.117.223.223
                                                                                                                                                              Jul 18, 2024 21:39:11.019007921 CEST4434976034.117.223.223192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:11.019083023 CEST49760443192.168.2.434.117.223.223
                                                                                                                                                              Jul 18, 2024 21:39:11.019282103 CEST49760443192.168.2.434.117.223.223
                                                                                                                                                              Jul 18, 2024 21:39:11.019304037 CEST4434976034.117.223.223192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:11.530314922 CEST4434976034.117.223.223192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:11.530378103 CEST49760443192.168.2.434.117.223.223
                                                                                                                                                              Jul 18, 2024 21:39:11.545576096 CEST49760443192.168.2.434.117.223.223
                                                                                                                                                              Jul 18, 2024 21:39:11.545613050 CEST4434976034.117.223.223192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:11.545845032 CEST4434976034.117.223.223192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:11.545850039 CEST49761443192.168.2.452.25.171.187
                                                                                                                                                              Jul 18, 2024 21:39:11.545903921 CEST4434976152.25.171.187192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:11.545965910 CEST49761443192.168.2.452.25.171.187
                                                                                                                                                              Jul 18, 2024 21:39:11.546551943 CEST49761443192.168.2.452.25.171.187
                                                                                                                                                              Jul 18, 2024 21:39:11.546569109 CEST4434976152.25.171.187192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:11.594516039 CEST49760443192.168.2.434.117.223.223
                                                                                                                                                              Jul 18, 2024 21:39:11.594541073 CEST49760443192.168.2.434.117.223.223
                                                                                                                                                              Jul 18, 2024 21:39:11.594558001 CEST4434976034.117.223.223192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:11.726342916 CEST4434976034.117.223.223192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:11.726414919 CEST4434976034.117.223.223192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:11.726511955 CEST49760443192.168.2.434.117.223.223
                                                                                                                                                              Jul 18, 2024 21:39:11.726803064 CEST49760443192.168.2.434.117.223.223
                                                                                                                                                              Jul 18, 2024 21:39:11.726821899 CEST4434976034.117.223.223192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:11.767978907 CEST49762443192.168.2.434.117.223.223
                                                                                                                                                              Jul 18, 2024 21:39:11.768075943 CEST4434976234.117.223.223192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:11.768153906 CEST49762443192.168.2.434.117.223.223
                                                                                                                                                              Jul 18, 2024 21:39:11.768444061 CEST49762443192.168.2.434.117.223.223
                                                                                                                                                              Jul 18, 2024 21:39:11.768480062 CEST4434976234.117.223.223192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:12.168545961 CEST4434976152.25.171.187192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:12.220391989 CEST49761443192.168.2.452.25.171.187
                                                                                                                                                              Jul 18, 2024 21:39:12.220566988 CEST49761443192.168.2.452.25.171.187
                                                                                                                                                              Jul 18, 2024 21:39:12.220573902 CEST4434976152.25.171.187192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:12.221559048 CEST49761443192.168.2.452.25.171.187
                                                                                                                                                              Jul 18, 2024 21:39:12.221565008 CEST4434976152.25.171.187192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:12.221606016 CEST49761443192.168.2.452.25.171.187
                                                                                                                                                              Jul 18, 2024 21:39:12.221611023 CEST4434976152.25.171.187192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:12.265938044 CEST4434976234.117.223.223192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:12.266006947 CEST49762443192.168.2.434.117.223.223
                                                                                                                                                              Jul 18, 2024 21:39:12.282118082 CEST49762443192.168.2.434.117.223.223
                                                                                                                                                              Jul 18, 2024 21:39:12.282151937 CEST4434976234.117.223.223192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:12.282377005 CEST4434976234.117.223.223192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:12.301320076 CEST49762443192.168.2.434.117.223.223
                                                                                                                                                              Jul 18, 2024 21:39:12.301354885 CEST49762443192.168.2.434.117.223.223
                                                                                                                                                              Jul 18, 2024 21:39:12.301359892 CEST4434976234.117.223.223192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:12.431586981 CEST4434976234.117.223.223192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:12.431674957 CEST4434976234.117.223.223192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:12.431730032 CEST49762443192.168.2.434.117.223.223
                                                                                                                                                              Jul 18, 2024 21:39:12.431922913 CEST49762443192.168.2.434.117.223.223
                                                                                                                                                              Jul 18, 2024 21:39:12.431956053 CEST4434976234.117.223.223192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:12.433514118 CEST4434976152.25.171.187192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:12.433617115 CEST4434976152.25.171.187192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:12.433672905 CEST49761443192.168.2.452.25.171.187
                                                                                                                                                              Jul 18, 2024 21:39:12.433768988 CEST49761443192.168.2.452.25.171.187
                                                                                                                                                              Jul 18, 2024 21:39:12.433785915 CEST4434976152.25.171.187192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:18.631653070 CEST49776443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:18.631697893 CEST44349776161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:18.631758928 CEST49776443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:18.903376102 CEST49776443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:18.903409004 CEST44349776161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:19.099011898 CEST49777443192.168.2.452.25.171.187
                                                                                                                                                              Jul 18, 2024 21:39:19.099047899 CEST4434977752.25.171.187192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:19.099116087 CEST49777443192.168.2.452.25.171.187
                                                                                                                                                              Jul 18, 2024 21:39:19.100420952 CEST49777443192.168.2.452.25.171.187
                                                                                                                                                              Jul 18, 2024 21:39:19.100435019 CEST4434977752.25.171.187192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:19.299844027 CEST49778443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:19.299880981 CEST44349778161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:19.299951077 CEST49778443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:19.582978010 CEST44349776161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:19.626673937 CEST49776443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:19.647701979 CEST49778443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:19.647721052 CEST44349778161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:19.648009062 CEST49779443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:19.648046017 CEST44349779161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:19.648154020 CEST49779443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:19.725950956 CEST4434977752.25.171.187192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:19.726414919 CEST49777443192.168.2.452.25.171.187
                                                                                                                                                              Jul 18, 2024 21:39:19.726438999 CEST4434977752.25.171.187192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:19.727848053 CEST49777443192.168.2.452.25.171.187
                                                                                                                                                              Jul 18, 2024 21:39:19.727854013 CEST4434977752.25.171.187192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:19.727881908 CEST49777443192.168.2.452.25.171.187
                                                                                                                                                              Jul 18, 2024 21:39:19.727886915 CEST4434977752.25.171.187192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:19.838099957 CEST49776443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:19.838139057 CEST44349776161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:19.838174105 CEST49779443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:19.838188887 CEST44349779161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:19.839776993 CEST49780443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:19.839828014 CEST44349780161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:19.840221882 CEST49780443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:19.842004061 CEST44349776161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:19.842078924 CEST49776443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:19.999762058 CEST4434977752.25.171.187192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:19.999846935 CEST4434977752.25.171.187192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:19.999910116 CEST49777443192.168.2.452.25.171.187
                                                                                                                                                              Jul 18, 2024 21:39:20.000052929 CEST49777443192.168.2.452.25.171.187
                                                                                                                                                              Jul 18, 2024 21:39:20.000088930 CEST4434977752.25.171.187192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:20.018294096 CEST49776443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:20.018318892 CEST49780443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:20.018336058 CEST44349780161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:20.018625975 CEST44349776161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:20.020848989 CEST49781443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:20.020878077 CEST44349781161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:20.020941973 CEST49781443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:20.065486908 CEST49776443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:20.065495968 CEST44349776161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:20.112353086 CEST49776443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:20.201667070 CEST44349776161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:20.201695919 CEST44349776161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:20.201704979 CEST44349776161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:20.201761007 CEST49776443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:20.201776028 CEST44349776161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:20.203471899 CEST49776443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:20.284806967 CEST44349778161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:20.301593065 CEST49776443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:20.301625013 CEST44349776161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:20.331207991 CEST49778443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:20.365091085 CEST49784443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:20.365127087 CEST44349784161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:20.365679026 CEST49784443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:20.373085022 CEST49784443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:20.373097897 CEST44349784161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:20.380369902 CEST49785443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:20.380408049 CEST44349785161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:20.380470037 CEST49785443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:20.380671978 CEST49785443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:20.380685091 CEST44349785161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:20.500603914 CEST44349779161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:20.549860954 CEST49779443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:20.684236050 CEST44349780161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:20.729043007 CEST49780443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:20.885562897 CEST49781443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:20.885597944 CEST44349781161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:20.917978048 CEST49778443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:20.918015957 CEST44349778161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:20.918812037 CEST49779443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:20.918831110 CEST44349779161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:20.919013977 CEST49780443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:20.919027090 CEST44349780161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:20.919327974 CEST44349778161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:20.919455051 CEST49778443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:20.920521021 CEST44349779161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:20.920594931 CEST49779443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:20.920613050 CEST44349780161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:20.920680046 CEST49780443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:21.001780033 CEST44349784161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:21.002708912 CEST49784443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:21.002717972 CEST44349784161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:21.003814936 CEST44349784161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:21.004512072 CEST49784443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:21.005842924 CEST44349785161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:21.006198883 CEST49785443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:21.006213903 CEST44349785161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:21.007693052 CEST44349785161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:21.007775068 CEST49785443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:21.036448956 CEST49785443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:21.036514997 CEST49784443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:21.036571980 CEST44349785161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:21.036622047 CEST44349784161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:21.036674023 CEST49784443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:21.078952074 CEST49785443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:21.078953981 CEST49784443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:21.078964949 CEST44349784161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:21.078977108 CEST44349785161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:21.125813961 CEST49785443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:21.125828981 CEST49784443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:21.253202915 CEST44349784161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:21.253242970 CEST44349784161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:21.253294945 CEST44349784161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:21.253308058 CEST49784443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:21.253331900 CEST49784443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:21.304877996 CEST49778443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:21.304917097 CEST49779443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:21.304958105 CEST49780443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:21.305205107 CEST44349779161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:21.305210114 CEST44349778161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:21.305469036 CEST44349780161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:21.322823048 CEST49784443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:21.322849989 CEST44349784161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:21.357351065 CEST49779443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:21.357376099 CEST44349779161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:21.357407093 CEST49778443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:21.357407093 CEST49780443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:21.357418060 CEST44349778161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:21.357430935 CEST44349780161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:21.401437044 CEST49779443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:21.401442051 CEST49778443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:21.401442051 CEST49780443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:21.487602949 CEST44349778161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:21.487634897 CEST44349778161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:21.487644911 CEST44349778161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:21.487682104 CEST49778443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:21.487708092 CEST44349778161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:21.487723112 CEST44349778161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:21.487812996 CEST49778443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:21.490298986 CEST44349779161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:21.490338087 CEST44349779161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:21.490392923 CEST49779443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:21.490420103 CEST44349779161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:21.490431070 CEST44349779161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:21.490472078 CEST49779443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:21.490482092 CEST44349779161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:21.490525007 CEST49779443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:21.491828918 CEST44349780161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:21.491894007 CEST44349780161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:21.491914988 CEST44349780161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:21.491951942 CEST49780443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:21.491961002 CEST44349780161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:21.491982937 CEST49780443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:21.492063999 CEST44349780161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:21.492111921 CEST49780443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:21.517270088 CEST44349781161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:21.564002037 CEST49781443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:21.644512892 CEST49778443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:21.644540071 CEST44349778161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:21.725676060 CEST49779443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:21.725709915 CEST44349779161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:21.827452898 CEST49780443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:21.827475071 CEST44349780161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:21.902470112 CEST497885437192.168.2.4161.97.134.106
                                                                                                                                                              Jul 18, 2024 21:39:21.908701897 CEST543749788161.97.134.106192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:21.909257889 CEST497885437192.168.2.4161.97.134.106
                                                                                                                                                              Jul 18, 2024 21:39:23.942637920 CEST49781443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:23.942652941 CEST44349781161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:23.943069935 CEST497885437192.168.2.4161.97.134.106
                                                                                                                                                              Jul 18, 2024 21:39:23.944303989 CEST44349781161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:23.944371939 CEST49781443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:23.949027061 CEST543749788161.97.134.106192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:23.979475975 CEST49796443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:23.979518890 CEST4434979695.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:23.980000019 CEST49796443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:23.980657101 CEST49797443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:23.980720997 CEST4434979795.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:23.980907917 CEST49797443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:23.981096029 CEST49797443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:23.981141090 CEST4434979795.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:23.981197119 CEST49796443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:23.981219053 CEST4434979695.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:24.041090965 CEST49781443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:24.041429996 CEST44349781161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:24.090018034 CEST49781443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:24.090029955 CEST44349781161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:24.124552965 CEST543749788161.97.134.106192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:24.126386881 CEST543749788161.97.134.106192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:24.126633883 CEST497885437192.168.2.4161.97.134.106
                                                                                                                                                              Jul 18, 2024 21:39:24.127336979 CEST497885437192.168.2.4161.97.134.106
                                                                                                                                                              Jul 18, 2024 21:39:24.132153034 CEST543749788161.97.134.106192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:24.143713951 CEST49781443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:24.218631029 CEST44349781161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:24.218664885 CEST44349781161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:24.218730927 CEST49781443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:24.218743086 CEST44349781161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:24.218774080 CEST44349781161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:24.218790054 CEST44349781161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:24.218799114 CEST49781443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:24.218822002 CEST49781443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:24.223375082 CEST49781443192.168.2.4161.97.135.85
                                                                                                                                                              Jul 18, 2024 21:39:24.223387957 CEST44349781161.97.135.85192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:24.648967981 CEST4434979695.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:24.649916887 CEST49796443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:24.649928093 CEST4434979695.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:24.649940968 CEST4434979795.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:24.651364088 CEST4434979695.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:24.652070999 CEST49796443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:24.691545010 CEST49797443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:24.912939072 CEST49797443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:24.912982941 CEST4434979795.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:24.917145014 CEST4434979795.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:24.917217016 CEST49797443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:24.924118996 CEST49799443192.168.2.4172.64.41.3
                                                                                                                                                              Jul 18, 2024 21:39:24.924168110 CEST44349799172.64.41.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:24.924248934 CEST49799443192.168.2.4172.64.41.3
                                                                                                                                                              Jul 18, 2024 21:39:24.926502943 CEST49800443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:24.926532984 CEST44349800162.159.61.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:24.926595926 CEST49800443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:24.926851034 CEST49799443192.168.2.4172.64.41.3
                                                                                                                                                              Jul 18, 2024 21:39:24.926870108 CEST44349799172.64.41.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:24.927035093 CEST49800443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:24.927050114 CEST44349800162.159.61.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:24.929193020 CEST49796443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:24.929301977 CEST49797443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:24.929352999 CEST4434979695.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:24.929527998 CEST4434979795.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:24.929546118 CEST49796443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:24.969670057 CEST49796443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:24.969682932 CEST49797443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:24.969696999 CEST4434979795.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:24.969701052 CEST4434979695.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:25.014337063 CEST49796443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:25.014405966 CEST49797443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:25.144989967 CEST4434979695.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:25.145052910 CEST4434979695.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:25.145214081 CEST49796443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:25.151640892 CEST49796443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:25.151663065 CEST4434979695.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:25.286290884 CEST49797443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:25.286314011 CEST4434979795.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:25.399296045 CEST44349799172.64.41.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:25.400201082 CEST49799443192.168.2.4172.64.41.3
                                                                                                                                                              Jul 18, 2024 21:39:25.400224924 CEST44349799172.64.41.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:25.401632071 CEST44349800162.159.61.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:25.401737928 CEST44349799172.64.41.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:25.401808023 CEST49799443192.168.2.4172.64.41.3
                                                                                                                                                              Jul 18, 2024 21:39:25.401994944 CEST49800443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:25.402029991 CEST44349800162.159.61.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:25.403503895 CEST44349800162.159.61.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:25.403563023 CEST49800443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:25.515084028 CEST49799443192.168.2.4172.64.41.3
                                                                                                                                                              Jul 18, 2024 21:39:25.515274048 CEST44349799172.64.41.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:25.515482903 CEST49799443192.168.2.4172.64.41.3
                                                                                                                                                              Jul 18, 2024 21:39:25.515507936 CEST44349799172.64.41.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:25.515733004 CEST49800443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:25.515952110 CEST44349800162.159.61.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:25.537147045 CEST49800443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:25.537239075 CEST44349800162.159.61.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:25.555016041 CEST49799443192.168.2.4172.64.41.3
                                                                                                                                                              Jul 18, 2024 21:39:25.618186951 CEST44349799172.64.41.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:25.618396997 CEST44349799172.64.41.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:25.618455887 CEST49799443192.168.2.4172.64.41.3
                                                                                                                                                              Jul 18, 2024 21:39:25.619731903 CEST49799443192.168.2.4172.64.41.3
                                                                                                                                                              Jul 18, 2024 21:39:25.619746923 CEST44349799172.64.41.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:25.642642021 CEST44349800162.159.61.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:25.642885923 CEST49800443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:25.643714905 CEST49800443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:25.643763065 CEST44349800162.159.61.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:25.648873091 CEST4434979795.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:25.648900032 CEST4434979795.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:25.648958921 CEST49797443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:25.648972034 CEST4434979795.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:25.649017096 CEST49797443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:25.929200888 CEST49797443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:25.929236889 CEST4434979795.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.011321068 CEST49801443192.168.2.4172.64.41.3
                                                                                                                                                              Jul 18, 2024 21:39:26.011364937 CEST44349801172.64.41.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.011488914 CEST49801443192.168.2.4172.64.41.3
                                                                                                                                                              Jul 18, 2024 21:39:26.012517929 CEST49802443192.168.2.4172.64.41.3
                                                                                                                                                              Jul 18, 2024 21:39:26.012533903 CEST44349802172.64.41.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.012721062 CEST49801443192.168.2.4172.64.41.3
                                                                                                                                                              Jul 18, 2024 21:39:26.012747049 CEST44349801172.64.41.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.012758970 CEST49802443192.168.2.4172.64.41.3
                                                                                                                                                              Jul 18, 2024 21:39:26.012950897 CEST49802443192.168.2.4172.64.41.3
                                                                                                                                                              Jul 18, 2024 21:39:26.012967110 CEST44349802172.64.41.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.379447937 CEST49804443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:26.379483938 CEST44349804162.159.61.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.380105019 CEST49804443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:26.381005049 CEST49805443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:26.381105900 CEST44349805162.159.61.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.381139040 CEST49804443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:26.381153107 CEST44349804162.159.61.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.381942034 CEST49805443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:26.382260084 CEST49806443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:26.382282019 CEST44349806162.159.61.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.382721901 CEST49807443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:26.382731915 CEST44349807162.159.61.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.382755995 CEST49806443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:26.382811069 CEST49807443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:26.382960081 CEST49805443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:26.382998943 CEST44349805162.159.61.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.383187056 CEST49807443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:26.383197069 CEST44349807162.159.61.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.383320093 CEST49806443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:26.383347034 CEST44349806162.159.61.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.499247074 CEST44349802172.64.41.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.499975920 CEST44349801172.64.41.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.500313997 CEST49801443192.168.2.4172.64.41.3
                                                                                                                                                              Jul 18, 2024 21:39:26.500386953 CEST44349801172.64.41.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.501863003 CEST44349801172.64.41.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.501936913 CEST49801443192.168.2.4172.64.41.3
                                                                                                                                                              Jul 18, 2024 21:39:26.540316105 CEST49802443192.168.2.4172.64.41.3
                                                                                                                                                              Jul 18, 2024 21:39:26.540352106 CEST44349802172.64.41.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.544011116 CEST44349802172.64.41.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.544085979 CEST49802443192.168.2.4172.64.41.3
                                                                                                                                                              Jul 18, 2024 21:39:26.552742004 CEST49802443192.168.2.4172.64.41.3
                                                                                                                                                              Jul 18, 2024 21:39:26.552938938 CEST44349802172.64.41.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.553057909 CEST49801443192.168.2.4172.64.41.3
                                                                                                                                                              Jul 18, 2024 21:39:26.553392887 CEST44349801172.64.41.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.597985983 CEST49801443192.168.2.4172.64.41.3
                                                                                                                                                              Jul 18, 2024 21:39:26.597985983 CEST49802443192.168.2.4172.64.41.3
                                                                                                                                                              Jul 18, 2024 21:39:26.598057032 CEST44349801172.64.41.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.598100901 CEST44349802172.64.41.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.643439054 CEST49801443192.168.2.4172.64.41.3
                                                                                                                                                              Jul 18, 2024 21:39:26.643439054 CEST49802443192.168.2.4172.64.41.3
                                                                                                                                                              Jul 18, 2024 21:39:26.693137884 CEST49810443192.168.2.4172.183.192.109
                                                                                                                                                              Jul 18, 2024 21:39:26.693196058 CEST44349810172.183.192.109192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.693272114 CEST49810443192.168.2.4172.183.192.109
                                                                                                                                                              Jul 18, 2024 21:39:26.693918943 CEST49810443192.168.2.4172.183.192.109
                                                                                                                                                              Jul 18, 2024 21:39:26.693943024 CEST44349810172.183.192.109192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.849788904 CEST44349806162.159.61.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.850045919 CEST49806443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:26.850094080 CEST44349806162.159.61.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.851578951 CEST44349806162.159.61.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.851634979 CEST49806443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:26.852018118 CEST49806443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:26.852112055 CEST44349806162.159.61.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.857734919 CEST44349804162.159.61.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.858721972 CEST49804443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:26.858736038 CEST44349804162.159.61.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.860174894 CEST44349804162.159.61.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.860511065 CEST49804443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:26.864126921 CEST49804443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:26.864208937 CEST44349804162.159.61.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.885554075 CEST44349805162.159.61.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.885767937 CEST49805443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:26.885788918 CEST44349805162.159.61.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.886825085 CEST44349805162.159.61.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.886878967 CEST49805443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:26.889678001 CEST44349807162.159.61.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.904978037 CEST49806443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:26.904999018 CEST44349806162.159.61.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.905225039 CEST49804443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:26.905234098 CEST44349804162.159.61.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.940380096 CEST49807443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:26.957927942 CEST49804443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:26.961939096 CEST49805443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:26.962145090 CEST44349805162.159.61.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.962297916 CEST49807443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:26.962304115 CEST44349807162.159.61.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.963459969 CEST44349807162.159.61.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.963741064 CEST49807443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:26.963907957 CEST49811443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:26.963956118 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.964179039 CEST49811443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:26.964240074 CEST49807443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:26.964303017 CEST44349807162.159.61.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:26.964442015 CEST49811443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:26.964459896 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:27.012242079 CEST49806443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:27.012248993 CEST49807443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:27.012255907 CEST44349807162.159.61.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:27.012279987 CEST49805443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:27.012290001 CEST44349805162.159.61.3192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:27.030699968 CEST49812443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:27.030730009 CEST4434981295.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:27.031158924 CEST49812443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:27.054336071 CEST49812443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:27.054348946 CEST4434981295.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:27.063196898 CEST49807443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:27.132750034 CEST49805443192.168.2.4162.159.61.3
                                                                                                                                                              Jul 18, 2024 21:39:27.211253881 CEST44349810172.183.192.109192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:27.299664974 CEST49810443192.168.2.4172.183.192.109
                                                                                                                                                              Jul 18, 2024 21:39:27.316165924 CEST49810443192.168.2.4172.183.192.109
                                                                                                                                                              Jul 18, 2024 21:39:27.316173077 CEST44349810172.183.192.109192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:27.316648006 CEST44349810172.183.192.109192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:27.316658974 CEST44349810172.183.192.109192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:27.316699982 CEST49810443192.168.2.4172.183.192.109
                                                                                                                                                              Jul 18, 2024 21:39:27.405543089 CEST49810443192.168.2.4172.183.192.109
                                                                                                                                                              Jul 18, 2024 21:39:27.405560017 CEST44349810172.183.192.109192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:27.406940937 CEST49810443192.168.2.4172.183.192.109
                                                                                                                                                              Jul 18, 2024 21:39:27.407063007 CEST44349810172.183.192.109192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:27.407517910 CEST49810443192.168.2.4172.183.192.109
                                                                                                                                                              Jul 18, 2024 21:39:27.407536983 CEST44349810172.183.192.109192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:27.407569885 CEST49810443192.168.2.4172.183.192.109
                                                                                                                                                              Jul 18, 2024 21:39:27.452497005 CEST44349810172.183.192.109192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:27.600380898 CEST44349810172.183.192.109192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:27.600572109 CEST44349810172.183.192.109192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:27.600631952 CEST49810443192.168.2.4172.183.192.109
                                                                                                                                                              Jul 18, 2024 21:39:27.630592108 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:27.636976957 CEST49811443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:27.637013912 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:27.637298107 CEST49810443192.168.2.4172.183.192.109
                                                                                                                                                              Jul 18, 2024 21:39:27.637336016 CEST44349810172.183.192.109192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:27.638494015 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:27.638555050 CEST49811443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:27.640384912 CEST49811443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:27.640469074 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:27.654495955 CEST49811443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:27.654508114 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:27.704982042 CEST49811443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:27.736620903 CEST4434981295.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:27.738480091 CEST49812443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:27.738497972 CEST4434981295.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:27.739516973 CEST4434981295.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:27.739592075 CEST49812443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:27.761554956 CEST49812443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:27.761744022 CEST4434981295.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:27.761856079 CEST49812443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:27.761864901 CEST4434981295.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:27.813927889 CEST49812443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:28.009754896 CEST49815443192.168.2.4172.183.192.109
                                                                                                                                                              Jul 18, 2024 21:39:28.009789944 CEST44349815172.183.192.109192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.009881020 CEST49815443192.168.2.4172.183.192.109
                                                                                                                                                              Jul 18, 2024 21:39:28.011799097 CEST49815443192.168.2.4172.183.192.109
                                                                                                                                                              Jul 18, 2024 21:39:28.011811018 CEST44349815172.183.192.109192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.024831057 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.024857044 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.024867058 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.024884939 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.024893999 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.024903059 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.024924040 CEST49811443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:28.024952888 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.024969101 CEST49811443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:28.024998903 CEST49811443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:28.026249886 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.026271105 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.026315928 CEST49811443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:28.026324034 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.026348114 CEST49811443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:28.026362896 CEST49811443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:28.040834904 CEST4434981295.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.040875912 CEST4434981295.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.040937901 CEST49812443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:28.040955067 CEST4434981295.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.041032076 CEST4434981295.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.042171001 CEST49812443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:28.042171001 CEST49812443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:28.042181969 CEST4434981295.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.124677896 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.124707937 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.124758005 CEST49811443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:28.124785900 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.124799967 CEST49811443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:28.125195026 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.125221014 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.125256062 CEST49811443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:28.125266075 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.125274897 CEST49811443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:28.125300884 CEST49811443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:28.127152920 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.127177954 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.127222061 CEST49811443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:28.127228022 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.127237082 CEST49811443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:28.127264023 CEST49811443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:28.128274918 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.128303051 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.128353119 CEST49811443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:28.128353119 CEST49811443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:28.128364086 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.130793095 CEST49811443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:28.154881001 CEST49816443192.168.2.4142.250.65.200
                                                                                                                                                              Jul 18, 2024 21:39:28.154927015 CEST44349816142.250.65.200192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.155558109 CEST49816443192.168.2.4142.250.65.200
                                                                                                                                                              Jul 18, 2024 21:39:28.156132936 CEST49816443192.168.2.4142.250.65.200
                                                                                                                                                              Jul 18, 2024 21:39:28.156148911 CEST44349816142.250.65.200192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.224293947 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.224322081 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.224478006 CEST49811443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:28.224555969 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.224631071 CEST49811443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:28.224971056 CEST49811443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:28.224989891 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.225009918 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.225055933 CEST49811443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:28.225078106 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.225101948 CEST49811443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:28.225429058 CEST49811443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:28.226356983 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.226376057 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.226423025 CEST49811443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:28.226442099 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.226466894 CEST49811443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:28.226488113 CEST49811443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:28.227011919 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.227030993 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.227071047 CEST49811443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:28.227076054 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.227087975 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.227112055 CEST49811443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:28.227112055 CEST49811443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:28.227171898 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.227226019 CEST49811443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:28.286277056 CEST49811443192.168.2.495.111.225.211
                                                                                                                                                              Jul 18, 2024 21:39:28.286348104 CEST4434981195.111.225.211192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.544934988 CEST44349815172.183.192.109192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.592793941 CEST49815443192.168.2.4172.183.192.109
                                                                                                                                                              Jul 18, 2024 21:39:28.653692007 CEST44349816142.250.65.200192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.694159031 CEST49816443192.168.2.4142.250.65.200
                                                                                                                                                              Jul 18, 2024 21:39:28.928371906 CEST49815443192.168.2.4172.183.192.109
                                                                                                                                                              Jul 18, 2024 21:39:28.928397894 CEST44349815172.183.192.109192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.928639889 CEST49816443192.168.2.4142.250.65.200
                                                                                                                                                              Jul 18, 2024 21:39:28.928666115 CEST44349816142.250.65.200192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.928914070 CEST44349815172.183.192.109192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.928982973 CEST49815443192.168.2.4172.183.192.109
                                                                                                                                                              Jul 18, 2024 21:39:28.929661036 CEST44349815172.183.192.109192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.930473089 CEST49815443192.168.2.4172.183.192.109
                                                                                                                                                              Jul 18, 2024 21:39:28.931587934 CEST49815443192.168.2.4172.183.192.109
                                                                                                                                                              Jul 18, 2024 21:39:28.931664944 CEST44349815172.183.192.109192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.932596922 CEST44349816142.250.65.200192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.932710886 CEST49816443192.168.2.4142.250.65.200
                                                                                                                                                              Jul 18, 2024 21:39:28.932722092 CEST44349816142.250.65.200192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.932770967 CEST49816443192.168.2.4142.250.65.200
                                                                                                                                                              Jul 18, 2024 21:39:28.938915014 CEST49816443192.168.2.4142.250.65.200
                                                                                                                                                              Jul 18, 2024 21:39:28.939095974 CEST49815443192.168.2.4172.183.192.109
                                                                                                                                                              Jul 18, 2024 21:39:28.939114094 CEST44349815172.183.192.109192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.939116955 CEST44349816142.250.65.200192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.939182043 CEST49815443192.168.2.4172.183.192.109
                                                                                                                                                              Jul 18, 2024 21:39:28.939444065 CEST49816443192.168.2.4142.250.65.200
                                                                                                                                                              Jul 18, 2024 21:39:28.939451933 CEST44349816142.250.65.200192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.984504938 CEST44349815172.183.192.109192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:28.993187904 CEST49815443192.168.2.4172.183.192.109
                                                                                                                                                              Jul 18, 2024 21:39:28.994920969 CEST49816443192.168.2.4142.250.65.200
                                                                                                                                                              Jul 18, 2024 21:39:29.091706038 CEST44349816142.250.65.200192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:29.091762066 CEST44349816142.250.65.200192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:29.091816902 CEST44349816142.250.65.200192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:29.091856956 CEST49816443192.168.2.4142.250.65.200
                                                                                                                                                              Jul 18, 2024 21:39:29.091861010 CEST44349816142.250.65.200192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:29.091872931 CEST44349816142.250.65.200192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:29.091903925 CEST49816443192.168.2.4142.250.65.200
                                                                                                                                                              Jul 18, 2024 21:39:29.091903925 CEST49816443192.168.2.4142.250.65.200
                                                                                                                                                              Jul 18, 2024 21:39:29.091916084 CEST44349816142.250.65.200192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:29.091955900 CEST44349816142.250.65.200192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:29.092034101 CEST44349816142.250.65.200192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:29.092058897 CEST49816443192.168.2.4142.250.65.200
                                                                                                                                                              Jul 18, 2024 21:39:29.092067003 CEST44349816142.250.65.200192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:29.092128992 CEST49816443192.168.2.4142.250.65.200
                                                                                                                                                              Jul 18, 2024 21:39:29.092134953 CEST44349816142.250.65.200192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:29.101383924 CEST44349816142.250.65.200192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:29.101452112 CEST49816443192.168.2.4142.250.65.200
                                                                                                                                                              Jul 18, 2024 21:39:29.101464033 CEST44349816142.250.65.200192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:29.101488113 CEST44349816142.250.65.200192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:29.101551056 CEST49816443192.168.2.4142.250.65.200
                                                                                                                                                              Jul 18, 2024 21:39:29.133013964 CEST44349815172.183.192.109192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:29.133035898 CEST44349815172.183.192.109192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:29.133097887 CEST49815443192.168.2.4172.183.192.109
                                                                                                                                                              Jul 18, 2024 21:39:29.133116961 CEST44349815172.183.192.109192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:29.133585930 CEST49815443192.168.2.4172.183.192.109
                                                                                                                                                              Jul 18, 2024 21:39:29.133642912 CEST44349815172.183.192.109192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:29.133690119 CEST44349815172.183.192.109192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:29.133716106 CEST49815443192.168.2.4172.183.192.109
                                                                                                                                                              Jul 18, 2024 21:39:29.133748055 CEST49815443192.168.2.4172.183.192.109
                                                                                                                                                              Jul 18, 2024 21:39:29.184343100 CEST44349816142.250.65.200192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:29.184551001 CEST44349816142.250.65.200192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:29.184647083 CEST44349816142.250.65.200192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:29.184712887 CEST49816443192.168.2.4142.250.65.200
                                                                                                                                                              Jul 18, 2024 21:39:29.184729099 CEST44349816142.250.65.200192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:29.184830904 CEST44349816142.250.65.200192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:29.184915066 CEST49816443192.168.2.4142.250.65.200
                                                                                                                                                              Jul 18, 2024 21:39:29.184916019 CEST44349816142.250.65.200192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:29.184945107 CEST44349816142.250.65.200192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:29.184988976 CEST49816443192.168.2.4142.250.65.200
                                                                                                                                                              Jul 18, 2024 21:39:29.185107946 CEST44349816142.250.65.200192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:29.185734987 CEST44349816142.250.65.200192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:29.185815096 CEST49816443192.168.2.4142.250.65.200
                                                                                                                                                              Jul 18, 2024 21:39:29.185823917 CEST44349816142.250.65.200192.168.2.4
                                                                                                                                                              Jul 18, 2024 21:39:29.185914040 CEST49816443192.168.2.4142.250.65.200

                                                                                                                                                              DNS Queries

                                                                                                                                                              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                              Jul 18, 2024 21:38:06.020447016 CEST192.168.2.41.1.1.10x17Standard query (0)d11iilsblp9z11.cloudfront.netA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:38:54.000266075 CEST192.168.2.41.1.1.10x3dbbStandard query (0)www.bitcomet.comA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:05.909312010 CEST192.168.2.41.1.1.10xfc0cStandard query (0)d11iilsblp9z11.cloudfront.netA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:06.459711075 CEST192.168.2.41.1.1.10xe89cStandard query (0)analytics.apis.mcafee.comA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:07.953645945 CEST192.168.2.41.1.1.10xc355Standard query (0)honzik.avcdn.netA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:07.955897093 CEST192.168.2.41.1.1.10x9d04Standard query (0)v7event.stats.avast.comA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:08.775079966 CEST192.168.2.41.1.1.10xcd64Standard query (0)sadownload.mcafee.comA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:11.000627041 CEST192.168.2.41.1.1.10x695cStandard query (0)analytics.avcdn.netA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:14.151856899 CEST192.168.2.41.1.1.10x3d40Standard query (0)router.bittorrent.comA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:14.151979923 CEST192.168.2.41.1.1.10x5d80Standard query (0)router.bittorrent.com28IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:14.152290106 CEST192.168.2.41.1.1.10x662dStandard query (0)router.utorrent.comA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:14.152391911 CEST192.168.2.41.1.1.10x75c2Standard query (0)router.utorrent.com28IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:14.153083086 CEST192.168.2.41.1.1.10x2d85Standard query (0)dht.transmissionbt.comA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:14.153213978 CEST192.168.2.41.1.1.10x3ffbStandard query (0)dht.transmissionbt.com28IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:14.153465986 CEST192.168.2.41.1.1.10x7daaStandard query (0)router.silotis.usA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:14.153687000 CEST192.168.2.41.1.1.10x4d7Standard query (0)router.silotis.us28IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:14.154856920 CEST192.168.2.41.1.1.10xdc37Standard query (0)dht.libtorrent.orgA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:14.154978991 CEST192.168.2.41.1.1.10xebf3Standard query (0)dht.libtorrent.org28IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:15.158055067 CEST192.168.2.41.1.1.10xebf3Standard query (0)dht.libtorrent.org28IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:15.158133030 CEST192.168.2.41.1.1.10x75c2Standard query (0)router.utorrent.com28IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:15.158155918 CEST192.168.2.41.1.1.10xdc37Standard query (0)dht.libtorrent.orgA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:15.158174038 CEST192.168.2.41.1.1.10x662dStandard query (0)router.utorrent.comA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:15.158199072 CEST192.168.2.41.1.1.10x5d80Standard query (0)router.bittorrent.com28IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:15.158210039 CEST192.168.2.41.1.1.10x3d40Standard query (0)router.bittorrent.comA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:16.173799038 CEST192.168.2.41.1.1.10x3d40Standard query (0)router.bittorrent.comA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:16.173847914 CEST192.168.2.41.1.1.10x5d80Standard query (0)router.bittorrent.com28IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:16.173866034 CEST192.168.2.41.1.1.10x662dStandard query (0)router.utorrent.comA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:16.173896074 CEST192.168.2.41.1.1.10xdc37Standard query (0)dht.libtorrent.orgA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:16.173917055 CEST192.168.2.41.1.1.10x75c2Standard query (0)router.utorrent.com28IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:16.173932076 CEST192.168.2.41.1.1.10xebf3Standard query (0)dht.libtorrent.org28IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:18.190534115 CEST192.168.2.41.1.1.10xebf3Standard query (0)dht.libtorrent.org28IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:18.190561056 CEST192.168.2.41.1.1.10x75c2Standard query (0)router.utorrent.com28IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:18.190577984 CEST192.168.2.41.1.1.10xdc37Standard query (0)dht.libtorrent.orgA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:18.190597057 CEST192.168.2.41.1.1.10x662dStandard query (0)router.utorrent.comA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:18.190610886 CEST192.168.2.41.1.1.10x5d80Standard query (0)router.bittorrent.com28IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:18.190639019 CEST192.168.2.41.1.1.10x3d40Standard query (0)router.bittorrent.comA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:18.466186047 CEST192.168.2.41.1.1.10xd45eStandard query (0)update.bitcomet.comA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:18.466325045 CEST192.168.2.41.1.1.10xc925Standard query (0)update.bitcomet.com28IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:20.334137917 CEST192.168.2.41.1.1.10x2459Standard query (0)inside.bitcomet.comA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:20.345772982 CEST192.168.2.41.1.1.10xb407Standard query (0)inside.bitcomet.comA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:20.346076965 CEST192.168.2.41.1.1.10x22f8Standard query (0)inside.bitcomet.com65IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:20.509413004 CEST192.168.2.41.1.1.10x861cStandard query (0)sadownload.mcafee.comA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:22.192523003 CEST192.168.2.41.1.1.10x3d40Standard query (0)router.bittorrent.comA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:22.192545891 CEST192.168.2.41.1.1.10x5d80Standard query (0)router.bittorrent.com28IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:22.192573071 CEST192.168.2.41.1.1.10x662dStandard query (0)router.utorrent.comA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:22.192590952 CEST192.168.2.41.1.1.10xdc37Standard query (0)dht.libtorrent.orgA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:22.192615986 CEST192.168.2.41.1.1.10x75c2Standard query (0)router.utorrent.com28IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:22.192631006 CEST192.168.2.41.1.1.10xebf3Standard query (0)dht.libtorrent.org28IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:23.884289980 CEST192.168.2.41.1.1.10x1535Standard query (0)apphit.comA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:23.884749889 CEST192.168.2.41.1.1.10xe8faStandard query (0)apphit.com65IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:23.885468006 CEST192.168.2.41.1.1.10x189aStandard query (0)apphit.comA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:23.886389017 CEST192.168.2.41.1.1.10xf46aStandard query (0)inside.bitcomet.comA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:23.975413084 CEST192.168.2.41.1.1.10x15bcStandard query (0)appassets.bitcomet.comA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:23.975851059 CEST192.168.2.41.1.1.10x6f77Standard query (0)appassets.bitcomet.com65IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:23.976526976 CEST192.168.2.41.1.1.10x6d8eStandard query (0)appassets.bitcomet.comA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:23.986361027 CEST192.168.2.41.1.1.10xa7fbStandard query (0)appassets.bitcomet.comA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:24.914158106 CEST192.168.2.41.1.1.10xb1d7Standard query (0)chrome.cloudflare-dns.comA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:24.914814949 CEST192.168.2.41.1.1.10x27aStandard query (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:24.915282011 CEST192.168.2.41.1.1.10xadccStandard query (0)chrome.cloudflare-dns.comA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:24.915514946 CEST192.168.2.41.1.1.10x2ce8Standard query (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:30.353543997 CEST192.168.2.41.1.1.10xbf09Standard query (0)appassets.bitcomet.comA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:30.353884935 CEST192.168.2.41.1.1.10x9051Standard query (0)appassets.bitcomet.com65IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:30.377914906 CEST192.168.2.41.1.1.10x859eStandard query (0)appassets.bitcomet.comA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:30.378252983 CEST192.168.2.41.1.1.10xbbf8Standard query (0)honzik.avcdn.netA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:36.094136953 CEST192.168.2.41.1.1.10x10e5Standard query (0)analytics.avcdn.netA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:36.099195004 CEST192.168.2.41.1.1.10x1cb5Standard query (0)shepherd.avcdn.netA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:37.311589003 CEST192.168.2.41.1.1.10x3bdeStandard query (0)honzik.avcdn.netA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:38.351672888 CEST192.168.2.41.1.1.10xa985Standard query (0)shepherd.avcdn.netA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:39.341792107 CEST192.168.2.41.1.1.10x133eStandard query (0)honzik.avcdn.netA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:39.342236042 CEST192.168.2.41.1.1.10xe440Standard query (0)honzik.avcdn.net28IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:40.321389914 CEST192.168.2.41.1.1.10xfe55Standard query (0)honzik.avcdn.netA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:40.321650982 CEST192.168.2.41.1.1.10xf84dStandard query (0)honzik.avcdn.net28IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:51.576869965 CEST192.168.2.41.1.1.10x5d77Standard query (0)sadownload.mcafee.comA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:52.518529892 CEST192.168.2.41.1.1.10x4a5cStandard query (0)analytics.avcdn.netA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:53.539355993 CEST192.168.2.41.1.1.10x9110Standard query (0)analytics.avcdn.netA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:53.645165920 CEST192.168.2.41.1.1.10x3591Standard query (0)shepherd.avcdn.netA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:53.904268980 CEST192.168.2.41.1.1.10x884fStandard query (0)analytics.apis.mcafee.comA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:54.502242088 CEST192.168.2.41.1.1.10x2b32Standard query (0)honzik.avcdn.netA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:54.502800941 CEST192.168.2.41.1.1.10x4004Standard query (0)honzik.avcdn.net28IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:40:03.009404898 CEST192.168.2.41.1.1.10x3e00Standard query (0)sadownload.mcafee.comA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:40:14.060288906 CEST192.168.2.41.1.1.10xe9f8Standard query (0)sadownload.mcafee.comA (IP address)IN (0x0001)false

                                                                                                                                                              DNS Answers

                                                                                                                                                              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                              Jul 18, 2024 21:38:06.046114922 CEST1.1.1.1192.168.2.40x17No error (0)d11iilsblp9z11.cloudfront.net13.249.12.125A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:38:06.046114922 CEST1.1.1.1192.168.2.40x17No error (0)d11iilsblp9z11.cloudfront.net13.249.12.63A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:38:06.046114922 CEST1.1.1.1192.168.2.40x17No error (0)d11iilsblp9z11.cloudfront.net13.249.12.203A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:38:06.046114922 CEST1.1.1.1192.168.2.40x17No error (0)d11iilsblp9z11.cloudfront.net13.249.12.80A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:38:54.031037092 CEST1.1.1.1192.168.2.40x3dbbNo error (0)www.bitcomet.combitcomet.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:38:54.031037092 CEST1.1.1.1192.168.2.40x3dbbNo error (0)bitcomet.com161.97.135.85A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:05.925430059 CEST1.1.1.1192.168.2.40xfc0cNo error (0)d11iilsblp9z11.cloudfront.net143.204.205.88A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:05.925430059 CEST1.1.1.1192.168.2.40xfc0cNo error (0)d11iilsblp9z11.cloudfront.net143.204.205.105A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:05.925430059 CEST1.1.1.1192.168.2.40xfc0cNo error (0)d11iilsblp9z11.cloudfront.net143.204.205.21A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:05.925430059 CEST1.1.1.1192.168.2.40xfc0cNo error (0)d11iilsblp9z11.cloudfront.net143.204.205.208A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:06.467540026 CEST1.1.1.1192.168.2.40xe89cNo error (0)analytics.apis.mcafee.commosaic-orio.apis.mcafee.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:06.467540026 CEST1.1.1.1192.168.2.40xe89cNo error (0)mosaic-orio.apis.mcafee.com52.25.171.187A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:06.467540026 CEST1.1.1.1192.168.2.40xe89cNo error (0)mosaic-orio.apis.mcafee.com52.40.60.95A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:06.467540026 CEST1.1.1.1192.168.2.40xe89cNo error (0)mosaic-orio.apis.mcafee.com54.149.119.32A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:06.467540026 CEST1.1.1.1192.168.2.40xe89cNo error (0)mosaic-orio.apis.mcafee.com52.12.249.73A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:06.467540026 CEST1.1.1.1192.168.2.40xe89cNo error (0)mosaic-orio.apis.mcafee.com35.163.136.59A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:06.467540026 CEST1.1.1.1192.168.2.40xe89cNo error (0)mosaic-orio.apis.mcafee.com18.236.20.221A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:06.467540026 CEST1.1.1.1192.168.2.40xe89cNo error (0)mosaic-orio.apis.mcafee.com52.27.94.100A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:06.467540026 CEST1.1.1.1192.168.2.40xe89cNo error (0)mosaic-orio.apis.mcafee.com54.68.165.193A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:07.964207888 CEST1.1.1.1192.168.2.40xc355No error (0)honzik.avcdn.nets-honzik.avcdn.net.edgekey.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:07.964351892 CEST1.1.1.1192.168.2.40x9d04No error (0)v7event.stats.avast.comanalytics.ff.avast.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:07.964351892 CEST1.1.1.1192.168.2.40x9d04No error (0)analytics.ff.avast.comanalytics-prod-gcp.ff.avast.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:07.964351892 CEST1.1.1.1192.168.2.40x9d04No error (0)analytics-prod-gcp.ff.avast.com34.117.223.223A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:08.784219980 CEST1.1.1.1192.168.2.40xcd64No error (0)sadownload.mcafee.comsadownload-r53.awsconsumer.mcafee.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:08.784219980 CEST1.1.1.1192.168.2.40xcd64No error (0)sadownload-r53.awsconsumer.mcafee.comsadownload.mcafee.com.edgesuite.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:11.018448114 CEST1.1.1.1192.168.2.40x695cNo error (0)analytics.avcdn.netanalytics.ff.avast.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:11.018448114 CEST1.1.1.1192.168.2.40x695cNo error (0)analytics.ff.avast.comanalytics-prod-gcp.ff.avast.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:11.018448114 CEST1.1.1.1192.168.2.40x695cNo error (0)analytics-prod-gcp.ff.avast.com34.117.223.223A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:14.162837982 CEST1.1.1.1192.168.2.40x3ffbNo error (0)dht.transmissionbt.com28IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:14.163660049 CEST1.1.1.1192.168.2.40x4d7No error (0)router.silotis.us28IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:14.163695097 CEST1.1.1.1192.168.2.40x2d85No error (0)dht.transmissionbt.com87.98.162.88A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:14.163695097 CEST1.1.1.1192.168.2.40x2d85No error (0)dht.transmissionbt.com212.129.33.59A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:18.486069918 CEST1.1.1.1192.168.2.40xd45eNo error (0)update.bitcomet.com161.97.135.85A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:18.487575054 CEST1.1.1.1192.168.2.40xc925No error (0)update.bitcomet.com28IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:20.353432894 CEST1.1.1.1192.168.2.40x2459No error (0)inside.bitcomet.com161.97.135.85A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:20.364183903 CEST1.1.1.1192.168.2.40xb407No error (0)inside.bitcomet.com161.97.135.85A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:20.520313978 CEST1.1.1.1192.168.2.40x861cNo error (0)sadownload.mcafee.comsadownload-r53.awsconsumer.mcafee.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:20.520313978 CEST1.1.1.1192.168.2.40x861cNo error (0)sadownload-r53.awsconsumer.mcafee.comsadownload.mcafee.com.edgesuite.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:23.906335115 CEST1.1.1.1192.168.2.40xf46aNo error (0)inside.bitcomet.com161.97.135.85A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:23.916254997 CEST1.1.1.1192.168.2.40x1535No error (0)apphit.com95.111.225.211A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:23.985265017 CEST1.1.1.1192.168.2.40x6d8eName error (3)appassets.bitcomet.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:23.994544983 CEST1.1.1.1192.168.2.40x6f77Name error (3)appassets.bitcomet.comnonenone65IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:23.996781111 CEST1.1.1.1192.168.2.40x15bcName error (3)appassets.bitcomet.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:24.004678965 CEST1.1.1.1192.168.2.40xa7fbName error (3)appassets.bitcomet.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:24.063704967 CEST1.1.1.1192.168.2.40x189aNo error (0)apphit.com95.111.225.211A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:24.921474934 CEST1.1.1.1192.168.2.40xb1d7No error (0)chrome.cloudflare-dns.com172.64.41.3A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:24.921474934 CEST1.1.1.1192.168.2.40xb1d7No error (0)chrome.cloudflare-dns.com162.159.61.3A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:24.922110081 CEST1.1.1.1192.168.2.40x27aNo error (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:24.923171997 CEST1.1.1.1192.168.2.40x2ce8No error (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:24.923405886 CEST1.1.1.1192.168.2.40xadccNo error (0)chrome.cloudflare-dns.com162.159.61.3A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:24.923405886 CEST1.1.1.1192.168.2.40xadccNo error (0)chrome.cloudflare-dns.com172.64.41.3A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:30.371000051 CEST1.1.1.1192.168.2.40x9051Name error (3)appassets.bitcomet.comnonenone65IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:30.372694016 CEST1.1.1.1192.168.2.40xbf09Name error (3)appassets.bitcomet.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:30.392241955 CEST1.1.1.1192.168.2.40xbbf8No error (0)honzik.avcdn.nets-honzik.avcdn.net.edgekey.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:30.400012016 CEST1.1.1.1192.168.2.40x859eName error (3)appassets.bitcomet.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:36.101722002 CEST1.1.1.1192.168.2.40x10e5No error (0)analytics.avcdn.netanalytics.ff.avast.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:36.101722002 CEST1.1.1.1192.168.2.40x10e5No error (0)analytics.ff.avast.comanalytics-prod-gcp.ff.avast.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:36.101722002 CEST1.1.1.1192.168.2.40x10e5No error (0)analytics-prod-gcp.ff.avast.com34.117.223.223A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:36.108319998 CEST1.1.1.1192.168.2.40x1cb5No error (0)shepherd.avcdn.netshepherd.ff.avast.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:36.108319998 CEST1.1.1.1192.168.2.40x1cb5No error (0)shepherd.ff.avast.comshepherd-gcp.ff.avast.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:36.108319998 CEST1.1.1.1192.168.2.40x1cb5No error (0)shepherd-gcp.ff.avast.com34.160.176.28A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:37.319504976 CEST1.1.1.1192.168.2.40x3bdeNo error (0)honzik.avcdn.nets-honzik.avcdn.net.edgekey.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:38.358799934 CEST1.1.1.1192.168.2.40xa985No error (0)shepherd.avcdn.netshepherd.ff.avast.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:38.358799934 CEST1.1.1.1192.168.2.40xa985No error (0)shepherd.ff.avast.comshepherd-gcp.ff.avast.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:38.358799934 CEST1.1.1.1192.168.2.40xa985No error (0)shepherd-gcp.ff.avast.com34.160.176.28A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:39.351089954 CEST1.1.1.1192.168.2.40x133eNo error (0)honzik.avcdn.nets-honzik.avcdn.net.edgekey.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:39.437155008 CEST1.1.1.1192.168.2.40xe440No error (0)honzik.avcdn.nets-honzik.avcdn.net.edgekey.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:40.329463959 CEST1.1.1.1192.168.2.40xfe55No error (0)honzik.avcdn.nets-honzik.avcdn.net.edgekey.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:40.332082033 CEST1.1.1.1192.168.2.40xf84dNo error (0)honzik.avcdn.nets-honzik.avcdn.net.edgekey.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:43.537460089 CEST1.1.1.1192.168.2.40xb9c3No error (0)prod.globalsign.map.fastly.net151.101.2.133A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:43.537460089 CEST1.1.1.1192.168.2.40xb9c3No error (0)prod.globalsign.map.fastly.net151.101.66.133A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:43.537460089 CEST1.1.1.1192.168.2.40xb9c3No error (0)prod.globalsign.map.fastly.net151.101.194.133A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:43.537460089 CEST1.1.1.1192.168.2.40xb9c3No error (0)prod.globalsign.map.fastly.net151.101.130.133A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:51.583827019 CEST1.1.1.1192.168.2.40x5d77No error (0)sadownload.mcafee.comsadownload-r53.awsconsumer.mcafee.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:51.583827019 CEST1.1.1.1192.168.2.40x5d77No error (0)sadownload-r53.awsconsumer.mcafee.comsadownload.mcafee.com.edgesuite.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:52.526156902 CEST1.1.1.1192.168.2.40x4a5cNo error (0)analytics.avcdn.netanalytics.ff.avast.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:52.526156902 CEST1.1.1.1192.168.2.40x4a5cNo error (0)analytics.ff.avast.comanalytics-prod-gcp.ff.avast.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:52.526156902 CEST1.1.1.1192.168.2.40x4a5cNo error (0)analytics-prod-gcp.ff.avast.com34.117.223.223A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:53.548980951 CEST1.1.1.1192.168.2.40x9110No error (0)analytics.avcdn.netanalytics.ff.avast.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:53.548980951 CEST1.1.1.1192.168.2.40x9110No error (0)analytics.ff.avast.comanalytics-prod-gcp.ff.avast.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:53.548980951 CEST1.1.1.1192.168.2.40x9110No error (0)analytics-prod-gcp.ff.avast.com34.117.223.223A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:53.652046919 CEST1.1.1.1192.168.2.40x3591No error (0)shepherd.avcdn.netshepherd.ff.avast.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:53.652046919 CEST1.1.1.1192.168.2.40x3591No error (0)shepherd.ff.avast.comshepherd-gcp.ff.avast.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:53.652046919 CEST1.1.1.1192.168.2.40x3591No error (0)shepherd-gcp.ff.avast.com34.160.176.28A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:53.912810087 CEST1.1.1.1192.168.2.40x884fNo error (0)analytics.apis.mcafee.commosaic-orio.apis.mcafee.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:53.912810087 CEST1.1.1.1192.168.2.40x884fNo error (0)mosaic-orio.apis.mcafee.com35.167.248.78A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:53.912810087 CEST1.1.1.1192.168.2.40x884fNo error (0)mosaic-orio.apis.mcafee.com52.37.69.68A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:53.912810087 CEST1.1.1.1192.168.2.40x884fNo error (0)mosaic-orio.apis.mcafee.com54.149.154.10A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:53.912810087 CEST1.1.1.1192.168.2.40x884fNo error (0)mosaic-orio.apis.mcafee.com52.12.249.73A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:53.912810087 CEST1.1.1.1192.168.2.40x884fNo error (0)mosaic-orio.apis.mcafee.com54.149.119.32A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:53.912810087 CEST1.1.1.1192.168.2.40x884fNo error (0)mosaic-orio.apis.mcafee.com54.68.165.193A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:53.912810087 CEST1.1.1.1192.168.2.40x884fNo error (0)mosaic-orio.apis.mcafee.com52.27.94.100A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:53.912810087 CEST1.1.1.1192.168.2.40x884fNo error (0)mosaic-orio.apis.mcafee.com35.163.4.159A (IP address)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:54.516870975 CEST1.1.1.1192.168.2.40x2b32No error (0)honzik.avcdn.nets-honzik.avcdn.net.edgekey.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:39:54.518341064 CEST1.1.1.1192.168.2.40x4004No error (0)honzik.avcdn.nets-honzik.avcdn.net.edgekey.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:40:03.018516064 CEST1.1.1.1192.168.2.40x3e00No error (0)sadownload.mcafee.comsadownload-r53.awsconsumer.mcafee.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:40:03.018516064 CEST1.1.1.1192.168.2.40x3e00No error (0)sadownload-r53.awsconsumer.mcafee.comsadownload.mcafee.com.edgesuite.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:40:14.067236900 CEST1.1.1.1192.168.2.40xe9f8No error (0)sadownload.mcafee.comsadownload-r53.awsconsumer.mcafee.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                              Jul 18, 2024 21:40:14.067236900 CEST1.1.1.1192.168.2.40xe9f8No error (0)sadownload-r53.awsconsumer.mcafee.comsadownload.mcafee.com.edgesuite.netCNAME (Canonical name)IN (0x0001)false

                                                                                                                                                              HTTP Packets

                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              0192.168.2.44975534.117.223.223806576C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              Jul 18, 2024 21:39:07.975289106 CEST175OUTPOST /cgi-bin/iavsevents.cgi HTTP/1.1
                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                              Content-Type: iavs4/stats
                                                                                                                                                              User-Agent: AVG Microstub/2.1
                                                                                                                                                              Content-Length: 268
                                                                                                                                                              Host: v7event.stats.avast.com
                                                                                                                                                              Jul 18, 2024 21:39:07.975311995 CEST268OUTData Raw: 63 6f 6f 6b 69 65 3d 6d 6d 6d 5f 69 72 73 5f 70 70 69 5f 39 30 32 5f 34 35 31 5f 6f 0a 65 64 69 74 69 6f 6e 3d 31 35 0a 65 76 65 6e 74 3d 6d 69 63 72 6f 73 74 75 62 2d 73 74 61 72 74 0a 6d 69 64 65 78 3d 33 46 35 43 37 43 44 34 34 44 31 46 36 41
                                                                                                                                                              Data Ascii: cookie=mmm_irs_ppi_902_451_oedition=15event=microstub-startmidex=3F5C7CD44D1F6AC769934CADA267B4DF43CEF16EBFB411D103FDD4B0F14B185Fstat_session=1840c678-d62a-4945-8e4f-36eaf3f0c4a5statsSendTime=1721331547os=win,10,0,2,19045,0,AMD64exe_ver
                                                                                                                                                              Jul 18, 2024 21:39:08.462748051 CEST96INHTTP/1.1 204 No Content
                                                                                                                                                              Server: nginx
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:08 GMT
                                                                                                                                                              Via: 1.1 google
                                                                                                                                                              Jul 18, 2024 21:39:10.390671968 CEST175OUTPOST /cgi-bin/iavsevents.cgi HTTP/1.1
                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                              Content-Type: iavs4/stats
                                                                                                                                                              User-Agent: AVG Microstub/2.1
                                                                                                                                                              Content-Length: 282
                                                                                                                                                              Host: v7event.stats.avast.com
                                                                                                                                                              Jul 18, 2024 21:39:10.390702963 CEST282OUTData Raw: 63 6f 6f 6b 69 65 3d 6d 6d 6d 5f 69 72 73 5f 70 70 69 5f 39 30 32 5f 34 35 31 5f 6f 0a 65 64 69 74 69 6f 6e 3d 31 35 0a 65 76 65 6e 74 3d 6d 69 63 72 6f 73 74 75 62 2d 64 6f 77 6e 6c 6f 61 64 0a 6d 69 64 65 78 3d 33 46 35 43 37 43 44 34 34 44 31
                                                                                                                                                              Data Ascii: cookie=mmm_irs_ppi_902_451_oedition=15event=microstub-downloadmidex=3F5C7CD44D1F6AC769934CADA267B4DF43CEF16EBFB411D103FDD4B0F14B185Fstat_session=1840c678-d62a-4945-8e4f-36eaf3f0c4a5statsSendTime=1721331549os=win,10,0,2,19045,0,AMD64exe_
                                                                                                                                                              Jul 18, 2024 21:39:10.515490055 CEST96INHTTP/1.1 204 No Content
                                                                                                                                                              Server: nginx
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:10 GMT
                                                                                                                                                              Via: 1.1 google


                                                                                                                                                              HTTPS Proxied Packets

                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              0192.168.2.44973413.249.12.1254436740C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:38:06 UTC233OUTPOST /o HTTP/1.1
                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                              Content-Type: application/json; Charset=UTF-8
                                                                                                                                                              Accept: */*
                                                                                                                                                              User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                              Content-Length: 122
                                                                                                                                                              Host: d11iilsblp9z11.cloudfront.net
                                                                                                                                                              2024-07-18 19:38:06 UTC122OUTData Raw: 7b 22 70 72 76 22 3a 20 22 30 2e 31 22 2c 22 70 6c 76 22 3a 20 22 32 2e 34 30 2e 31 2e 38 39 31 32 22 2c 22 6c 22 3a 20 22 65 6e 22 2c 22 61 22 3a 20 22 42 69 74 43 6f 6d 65 74 22 2c 22 69 22 3a 20 22 42 69 74 43 6f 6d 65 74 5f 50 75 62 5f 42 22 2c 22 73 22 3a 20 22 42 69 74 43 6f 6d 65 74 22 2c 22 6f 22 3a 20 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 22 7d
                                                                                                                                                              Data Ascii: {"prv": "0.1","plv": "2.40.1.8912","l": "en","a": "BitComet","i": "BitComet_Pub_B","s": "BitComet","o": "10.0.19045.2006"}
                                                                                                                                                              2024-07-18 19:38:07 UTC489INHTTP/1.1 200 OK
                                                                                                                                                              Content-Type: application/json
                                                                                                                                                              Content-Length: 10752
                                                                                                                                                              Connection: close
                                                                                                                                                              Server: awselb/2.0
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:38:07 GMT
                                                                                                                                                              x-true-request-id: 455d1345-91e2-45a4-acea-108c08c48e85
                                                                                                                                                              x-robots-tag: none
                                                                                                                                                              expires: Thu, 01 Jan 1970 00:00:00 GMT
                                                                                                                                                              cache-control: no-cache
                                                                                                                                                              X-Cache: Miss from cloudfront
                                                                                                                                                              Via: 1.1 b59465a36dda3b4ec573f7a87861306c.cloudfront.net (CloudFront)
                                                                                                                                                              X-Amz-Cf-Pop: CDG53-C1
                                                                                                                                                              X-Amz-Cf-Id: 4sG3i8BRTubpePZshAGDZX0F6mbNte1fK6gVYpM53inkrvRxoJrx5g==
                                                                                                                                                              2024-07-18 19:38:07 UTC10752INData Raw: 7b 22 76 22 3a 22 30 2e 31 22 2c 22 6c 22 3a 22 55 53 22 2c 22 69 22 3a 7b 22 63 75 22 3a 22 22 2c 22 63 74 22 3a 22 22 2c 22 63 70 22 3a 22 22 2c 22 63 74 75 22 3a 22 22 2c 22 63 6c 22 3a 22 22 2c 22 63 68 22 3a 22 22 2c 22 63 61 22 3a 22 76 35 2e 38 33 22 2c 22 63 66 22 3a 22 22 2c 22 63 70 69 22 3a 22 22 2c 22 63 70 73 22 3a 22 22 2c 22 63 64 22 3a 22 22 2c 22 63 70 72 22 3a 22 22 2c 22 63 70 70 22 3a 22 22 2c 22 63 66 6c 22 3a 22 22 2c 22 63 6a 22 3a 22 2b 31 22 2c 22 63 62 22 3a 22 22 2c 22 63 6f 64 22 3a 22 22 2c 22 63 74 70 22 3a 22 22 2c 22 63 65 70 22 3a 22 22 7d 2c 22 66 22 3a 7b 22 6d 22 3a 32 2c 22 78 22 3a 22 32 30 32 34 2d 30 37 2d 32 37 54 31 39 3a 33 38 3a 30 37 2e 31 33 35 5a 22 2c 22 61 22 3a 22 31 61 62 64 22 2c 22 64 22 3a 22 31 36 38
                                                                                                                                                              Data Ascii: {"v":"0.1","l":"US","i":{"cu":"","ct":"","cp":"","ctu":"","cl":"","ch":"","ca":"v5.83","cf":"","cpi":"","cps":"","cd":"","cpr":"","cpp":"","cfl":"","cj":"+1","cb":"","cod":"","ctp":"","cep":""},"f":{"m":2,"x":"2024-07-27T19:38:07.135Z","a":"1abd","d":"168


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              1192.168.2.44973513.249.12.1254436740C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:38:08 UTC326OUTPOST /zbd HTTP/1.1
                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                              Content-Type: application/json; Charset=UTF-8
                                                                                                                                                              Accept: */*
                                                                                                                                                              Authorization: Signature=c0ca984d9cd1b9e9ffdf6097b502a49003af5070b14ac3fa1760d15f36f3f81f
                                                                                                                                                              User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                              Content-Length: 273
                                                                                                                                                              Host: d11iilsblp9z11.cloudfront.net
                                                                                                                                                              2024-07-18 19:38:08 UTC273OUTData Raw: 7b 22 74 61 62 6c 65 22 3a 22 7a 62 5f 61 6e 61 6c 79 74 69 63 73 22 2c 22 64 61 74 61 22 3a 22 7b 5c 22 30 5c 22 3a 5c 22 5c 22 2c 5c 22 31 5c 22 3a 5c 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 5c 22 2c 5c 22 32 5c 22 3a 5c 22 32 30 32 34 30 37 31 38 31 35 33 38 30 36 5c 22 2c 5c 22 33 5c 22 3a 5c 22 42 69 74 43 6f 6d 65 74 5c 22 2c 5c 22 34 5c 22 3a 5c 22 42 69 74 43 6f 6d 65 74 5f 50 75 62 5f 42 5c 22 2c 5c 22 35 5c 22 3a 5c 22 5c 22 2c 5c 22 31 38 5c 22 3a 5c 22 5c 22 2c 5c 22 31 39 5c 22 3a 5c 22 5c 22 2c 5c 22 32 31 5c 22 3a 5c 22 5c 22 2c 5c 22 36 5c 22 3a 5c 22 31 5c 22 2c 5c 22 37 5c 22 3a 5c 22 32 2e 34 30 2e 31 2e 38 39 31 32 5c 22 2c 5c 22 31 35 5c 22 3a 30 2c 5c 22 32 32 5c
                                                                                                                                                              Data Ascii: {"table":"zb_analytics","data":"{\"0\":\"\",\"1\":\"9e146be9-c76a-4720-bcdb-53011b87bd06\",\"2\":\"20240718153806\",\"3\":\"BitComet\",\"4\":\"BitComet_Pub_B\",\"5\":\"\",\"18\":\"\",\"19\":\"\",\"21\":\"\",\"6\":\"1\",\"7\":\"2.40.1.8912\",\"15\":0,\"22\
                                                                                                                                                              2024-07-18 19:38:09 UTC427INHTTP/1.1 200 OK
                                                                                                                                                              Content-Type: application/json; charset=utf-8
                                                                                                                                                              Content-Length: 15
                                                                                                                                                              Connection: close
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:38:09 GMT
                                                                                                                                                              Access-Control-Allow-Origin: *
                                                                                                                                                              Access-Control-Allow-Methods: GET,HEAD,PUT,POST,DELETE
                                                                                                                                                              X-Cache: Miss from cloudfront
                                                                                                                                                              Via: 1.1 47140f009c2bd3561cd6dde4003253e2.cloudfront.net (CloudFront)
                                                                                                                                                              X-Amz-Cf-Pop: CDG53-C1
                                                                                                                                                              X-Amz-Cf-Id: JHRO2I2bYdoj0u8HeUwtuAcN-dUdecUwDXIRXlVbuI-l2yTbQcOKhg==
                                                                                                                                                              2024-07-18 19:38:09 UTC15INData Raw: 7b 22 53 74 61 74 75 73 22 3a 22 4f 4b 22 7d
                                                                                                                                                              Data Ascii: {"Status":"OK"}


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              2192.168.2.44973713.249.12.1254436740C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:38:10 UTC136OUTGET /f/AVG_AV/images/1509/EN.png HTTP/1.1
                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                              User-Agent: Inno Setup 6.1.2
                                                                                                                                                              Host: d11iilsblp9z11.cloudfront.net
                                                                                                                                                              2024-07-18 19:38:11 UTC608INHTTP/1.1 200 OK
                                                                                                                                                              Content-Type: image/png
                                                                                                                                                              Content-Length: 53151
                                                                                                                                                              Connection: close
                                                                                                                                                              Last-Modified: Wed, 01 May 2024 12:21:17 GMT
                                                                                                                                                              x-amz-server-side-encryption: AES256
                                                                                                                                                              x-amz-meta-cb-modifiedtime: Tue, 30 Apr 2024 07:13:32 GMT
                                                                                                                                                              x-amz-version-id: t0aKL0R4FYtf2ry_kAUySb7zudCs2Esv
                                                                                                                                                              Accept-Ranges: bytes
                                                                                                                                                              Server: AmazonS3
                                                                                                                                                              Date: Wed, 17 Jul 2024 23:46:38 GMT
                                                                                                                                                              ETag: "aee8e80b35dcb3cf2a5733ba99231560"
                                                                                                                                                              X-Cache: Hit from cloudfront
                                                                                                                                                              Via: 1.1 3e54eeb04035e3584145be33441ccbba.cloudfront.net (CloudFront)
                                                                                                                                                              X-Amz-Cf-Pop: CDG53-C1
                                                                                                                                                              X-Amz-Cf-Id: dACurST6EY01jHflu3vWrEAiSt5vgTILrgVJRYvycC7qeT1j5vqqbw==
                                                                                                                                                              Age: 71494
                                                                                                                                                              2024-07-18 19:38:11 UTC16384INData Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 23 00 00 01 18 08 06 00 00 00 8e 7f f6 42 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 cf 34 49 44 41 54 78 01 ec fd 09 98 1d c7 79 1e 0a bf 75 ce 99 7d c7 be e3 80 04 57 91 22 a8 d5 92 28 73 20 d9 f1 1a 13 94 1d c9 89 9d 70 90 dc eb dc fc ce bd 04 f3 c4 51 9c dc 84 83 3f 71 6c 3d c9 0d c1 27 cb 9f 38 b9 17 83 9b 45 b6 6c 99 a0 17 59 b2 2d 61 68 ad d4 46 50 0b 77 10 07 fb 8e d9 d7 b3 d4 5f 5f 75 55 77 75 77 f5 72 06 33 58 c8 7a c9 c6 e9 ae fa aa ea ab ea 9e fe de fe 6a 63 70 70 70 68 0e 9f da cd e1 e0 90 85 4f 1e 61 70 70 70 c8 85 02 1c 1c 1c 1c 1c 1c 1c 1c 6e 20 1c 19 71 70 68 1e 15 38 38
                                                                                                                                                              Data Ascii: PNGIHDR#BpHYssRGBgAMAa4IDATxyu}W"(s pQ?ql='8ElY-ahFPw__uUwuwr3XzjcppphOapppn qph88
                                                                                                                                                              2024-07-18 19:38:11 UTC16384INData Raw: c1 73 9b 52 b7 ca 71 25 13 05 b9 54 39 82 ae 97 34 43 73 5c fd ea 73 7a e9 0c aa 73 dd e5 a1 87 ac f7 ab b0 31 a3 7c 93 30 65 c5 47 31 68 d4 85 f4 3d 82 e0 45 58 36 74 38 62 c8 3c a9 e2 0f 20 70 1d 6b 19 1d ae eb 34 ac ce 07 8d 32 75 9d 76 21 ee 59 d1 5f 85 4f aa f2 86 55 7b 44 eb 61 96 01 84 ef 49 b4 1e 51 1c 88 94 31 a6 d2 96 23 f5 3e 88 78 db 8f 20 dc b6 43 2a 6e 0f 82 fa ef 89 e8 36 18 d1 2d fa 3c 3c 66 e4 69 c6 ef 43 d0 b5 f7 38 82 af 65 dd 1e bb 8c 3c 9e 8c e8 f5 a4 11 b7 c7 08 3b 62 c8 d9 8c 5b 39 92 b7 d9 ee bb 10 7e 0e d2 da f8 88 aa b3 59 cf 17 10 ee be 4b d3 d9 56 47 f3 9e 6b 3d 9f 31 74 2a 27 e8 a1 ef cb 20 e2 ed c0 23 e5 96 11 6e 23 b3 fe d1 76 d1 ed 17 6d 97 17 90 dc 2e 50 f9 25 3d ab 49 65 e8 e7 11 09 65 46 ef 85 ae 77 f4 19 5f 12 29 d1 b3
                                                                                                                                                              Data Ascii: sRq%T94Cs\szs1|0eG1h=EX6t8b< pk42uv!Y_OU{DaIQ1#>x C*n6-<<fiC8e<;b[9~YKVGk=1t*' #n#vm.P%=IeeFw_)
                                                                                                                                                              2024-07-18 19:38:11 UTC16384INData Raw: d3 53 ce 91 5e 3f f7 b0 e8 65 3e f3 74 4e cf 83 f9 4c 8f e0 da 30 1a f9 25 1c 8e fc 12 86 11 cc 6a d3 63 6d 2a 08 06 68 27 61 b7 ca 5b 4f 6b a6 76 dd 8f 5b 84 88 10 16 5a e7 07 21 07 ad 7a 2f 5e 73 59 6e 86 b0 c9 33 bf 26 ad 5e 91 84 77 77 46 74 3a 72 1b 85 95 44 1e 62 c0 12 e5 72 da e5 7c bd 5d cd 42 a9 d5 b0 76 4f 19 3a 27 56 81 a5 55 2d b9 cc 66 64 6d 65 a6 c9 e7 91 4b 2b 92 2d 2d 5d 42 6e 30 49 e4 ca 80 c6 8a 30 f1 72 e4 c2 e8 5c 3b 11 b1 a1 ac 7e 2b 09 f1 fa 45 a8 bd 1d 49 f1 95 25 a4 bd 16 bd 4c 39 32 2c 23 b0 77 7b 68 99 34 1d b2 e2 57 0a 59 ed 53 56 bf 15 64 a3 8c f4 7b a4 7f 2b f0 0c 20 7d 7d 0f 18 f2 69 f7 71 a9 c8 ca b3 8c e6 db 7d 39 f4 cc ca 63 25 da a2 19 2c b5 fc 6b f9 7b bb a1 58 fc bd ee af 0a 02 f2 41 7d ad 07 ad 7a 1c 80 f9 1f 91 b3 8d
                                                                                                                                                              Data Ascii: S^?e>tNL0%jcm*h'a[Okv[Z!z/^sYn3&^wwFt:rDbr|]BvO:'VU-fdmeK+--]Bn0I0r\;~+EI%L92,#w{h4WYSVd{+ }}iq}9c%,k{XA}z
                                                                                                                                                              2024-07-18 19:38:11 UTC3999INData Raw: 18 16 3f 58 40 25 a3 82 ed 64 10 eb 52 16 1f 65 ec 19 69 ed 29 a1 a2 82 04 2d a9 6c 71 5f 01 de 75 e6 2e aa b8 e3 1a f5 26 0a 69 54 34 e1 7e 8d b7 aa ac 9d 3e 3e 3d 8b ce 75 8f a1 b1 a3 7a dd 61 45 9f 9e af a4 9e 78 f8 71 32 5b 3f fc 10 ee 13 00 6e 51 e6 cf 9f ef c8 cc cd ee 0c a7 11 ff f1 0a 6a bc 7a 83 b7 d9 aa 69 3c 5b bf 7d 7a 03 14 e6 29 39 8c 5d 36 f5 f3 6b cc f4 7a 06 35 ba b6 f2 4d e5 91 e5 b8 dc af 1c b3 c0 b0 1d 93 df 39 73 7c bc 12 a6 7a 0e 17 bd 2e b6 e3 d3 cb f3 44 46 d0 f1 99 f0 fb ad 4c e7 23 ec 35 a0 e4 dd 90 87 01 ac 94 f2 86 e8 23 a3 39 2e 35 4d 7b 64 60 24 71 a6 ae 03 95 16 e1 21 9f 8f ce c4 a7 c5 8b cc 53 22 42 64 c0 26 41 f9 46 a6 70 3f 7c 69 0a d5 dd 7d 8c 7e bf f2 0c 15 44 92 74 e8 d2 54 f7 ad 9b d2 c2 04 fd e4 8b d4 8c b1 0f 4e ba
                                                                                                                                                              Data Ascii: ?X@%dRei)-lq_u.&iT4~>>=uzaExq2[?nQjzi<[}z)9]6kz5M9s|z.DFL#5#9.5M{d`$q!S"Bd&AFp?|i}~DtTN


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              3192.168.2.44973913.249.12.1254436740C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:38:20 UTC157OUTGET /f/BitComet/1548_Updated/BitComet_2.08a_setup.exe HTTP/1.1
                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                              User-Agent: Inno Setup 6.1.2
                                                                                                                                                              Host: d11iilsblp9z11.cloudfront.net
                                                                                                                                                              2024-07-18 19:38:20 UTC626INHTTP/1.1 200 OK
                                                                                                                                                              Content-Type: application/octet-stream
                                                                                                                                                              Content-Length: 27549456
                                                                                                                                                              Connection: close
                                                                                                                                                              Last-Modified: Wed, 03 Jul 2024 08:03:38 GMT
                                                                                                                                                              x-amz-server-side-encryption: AES256
                                                                                                                                                              x-amz-meta-cb-modifiedtime: Wed, 03 Jul 2024 07:21:16 GMT
                                                                                                                                                              x-amz-version-id: FVqyV2z8NGixUw5Iioe2SCcQi.dcxs5H
                                                                                                                                                              Accept-Ranges: bytes
                                                                                                                                                              Server: AmazonS3
                                                                                                                                                              Date: Thu, 18 Jul 2024 11:33:58 GMT
                                                                                                                                                              ETag: "4f45f9bd3cc4739bdc91a4d183c0dc01"
                                                                                                                                                              X-Cache: Hit from cloudfront
                                                                                                                                                              Via: 1.1 3a7672912a556fc61dac56701b81d9e2.cloudfront.net (CloudFront)
                                                                                                                                                              X-Amz-Cf-Pop: CDG53-C1
                                                                                                                                                              X-Amz-Cf-Id: ZfQjBxfR3CigKplgHBEIT8cjoAl2kwjWAhEoD3_IfO5xUk1bji-lVA==
                                                                                                                                                              Age: 35262
                                                                                                                                                              2024-07-18 19:38:20 UTC15758INData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ad 31 08 81 e9 50 66 d2 e9 50 66 d2 e9 50 66 d2 2a 5f 39 d2 eb 50 66 d2 e9 50 67 d2 4c 50 66 d2 2a 5f 3b d2 e6 50 66 d2 bd 73 56 d2 e3 50 66 d2 2e 56 60 d2 e8 50 66 d2 52 69 63 68 e9 50 66 d2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 35 ed 6f 5a 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 66 00 00 00 b6 00 00 00 08 00
                                                                                                                                                              Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1PfPfPf*_9PfPgLPf*_;PfsVPf.V`PfRichPfPEL5oZf
                                                                                                                                                              2024-07-18 19:38:20 UTC16384INData Raw: 13 00 00 a1 54 a2 42 00 8b 80 1c 01 00 00 85 c0 74 28 81 fb 00 58 43 00 75 20 50 6a 00 e8 5a 1a 00 00 57 bf e0 81 42 00 57 ff 15 04 81 40 00 85 c0 74 07 57 53 e8 3c 1a 00 00 ff 05 18 37 42 00 53 68 fb 03 00 00 56 e8 52 10 00 00 eb 07 c7 45 0c 0f 04 00 00 81 7d 0c 0f 04 00 00 74 0d 81 7d 0c 05 04 00 00 0f 85 98 01 00 00 83 65 fc 00 83 65 f8 00 53 68 fb 03 00 00 e8 26 10 00 00 53 e8 b3 13 00 00 85 c0 75 07 c7 45 fc 01 00 00 00 be f8 16 42 00 53 56 e8 bf 19 00 00 6a 01 e8 92 1d 00 00 85 c0 89 45 f4 74 3a 33 c0 33 ff 3b c6 74 32 8d 45 dc 50 8d 45 e8 50 8d 45 d4 50 56 ff 55 f4 85 c0 75 76 85 ff 74 03 66 21 07 56 e8 a9 12 00 00 8b f8 66 83 27 00 4f 4f 3b fe 66 c7 07 5c 00 75 ce 53 56 e8 70 19 00 00 56 e8 ea 12 00 00 33 ff 3b c7 74 03 66 89 38 8d 45 e0 50 8d 45
                                                                                                                                                              Data Ascii: TBt(XCu PjZWBW@tWS<7BShVRE}t}eeSh&SuEBSVjEt:33;t2EPEPEPVUuvtf!Vf'OO;f\uSVpV3;tf8EPE
                                                                                                                                                              2024-07-18 19:38:20 UTC16384INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 a2 42 00 89 13 40 00 7c 66 40 00 96 3a 40 00 0a 00 00 00 5c 00 00 00 ff ff ff ff ff ff ff ff 76 00 65 00 72 00 69 00 66 00 79 00 69 00 6e 00 67 00 20 00 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 65 00 72 00 3a 00 20 00 25 00 64 00 25 00 25 00 00 00 75 00 6e 00 70 00 61 00 63 00 6b 00 69 00 6e 00 67 00 20 00 64 00 61 00 74 00 61 00 3a 00 20 00 25 00 64 00 25 00 25 00 00 00 00 00 2e 00 2e 00 2e 00 20 00 25 00 64 00 25
                                                                                                                                                              Data Ascii: B@|f@:@\verifying installer: %d%%unpacking data: %d%%... %d%
                                                                                                                                                              2024-07-18 19:38:20 UTC16384INData Raw: fb ff 00 82 f9 ff 00 70 ea ff 00 3f 91 ff 00 26 73 7f 00 00 00 00 00 00 00 00 00 00 00 00 4c 5d c7 1f 14 64 ea ff 0c 6a ee ff 00 72 f8 ff 00 7e fa ff 00 8b fc ff 9f d7 fe ff 3f b5 fe ff 00 a4 ff ff 00 a9 ff ff 20 b9 ff ff 48 c9 ff ff 00 b9 ff ff 00 bd ff ff 7f df ff ff 7f e0 ff ff 00 c0 ff ff 00 bd ff ff 70 d8 ff ff 00 b4 ff ff 00 ae ff ff 00 a9 ff ff 7f d0 fe ff bf e6 fe ff 00 92 fc ff 00 86 fa ff 00 79 f8 ff 00 50 b4 ff 00 3b 93 ff 00 09 39 1f 00 00 00 00 00 00 00 00 22 5f e8 9f 17 67 ec ff 02 68 f7 ff 00 74 fa ff 00 80 fc ff 00 8c fd ff bf e5 ff ff 4f bb ff ff 00 a2 ff ff 00 a8 ff ff 30 bc ff ff 60 ce ff ff 00 b5 ff ff 00 b9 ff ff 7f dd ff ff 7f dd ff ff 00 bb ff ff 08 bb ff ff 80 da ff ff 08 b3 ff ff 00 ad ff ff 00 a7 ff ff bf e8 ff ff ef f9 ff ff 00
                                                                                                                                                              Data Ascii: p?&sL]djr~? HpyP;9"_ghtO0`
                                                                                                                                                              2024-07-18 19:38:20 UTC16384INData Raw: 00 00 00 00 00 00 01 00 00 50 28 00 19 00 78 00 0a 00 06 04 00 00 ff ff 82 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 50 0a 00 0a 00 15 00 14 00 ff ff 00 00 ff ff 82 00 ff ff 67 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 50 28 00 0a 00 78 00 0a 00 4c 00 00 00 ff ff 82 00 50 00 6c 00 65 00 61 00 73 00 65 00 20 00 77 00 61 00 69 00 74 00 20 00 77 00 68 00 69 00 6c 00 65 00 20 00 53 00 65 00 74 00 75 00 70 00 20 00 69 00 73 00 20 00 6c 00 6f 00 61 00 64 00 69 00 6e 00 67 00 2e 00 2e 00 2e 00 00 00 00 00 50 41 01 00 ff ff 00 00 00 00 00 00 00 00 40 04 c0 40 03 00 00 00 00 00 2c 01 8c 00 00 00 00 00 00 00 09 00 00 00 00 01 b0 65 30 7d 0e 66 d4 9a 00 00 00 00 00 00 00 00 00 00 00 00 00 50 00 00 00 00 2c 01 0f 00 10 04 00 00 ff ff 82 00 00 00 00 00 00
                                                                                                                                                              Data Ascii: P(xPgP(xLPlease wait while Setup is loading...PA@@,e0}fP,
                                                                                                                                                              2024-07-18 19:38:20 UTC16384INData Raw: cc 6f 11 04 8f 80 c5 1a 58 4e aa ef aa 8b 31 43 09 28 c5 08 46 44 7b 25 ec ff d8 8b 22 ec e4 89 f6 3c 56 ef 10 fe 8e 2f 48 b5 de fc ff d3 1e 54 3d e4 33 fd ba 22 b9 22 d1 67 e3 05 44 7d de 46 c2 3c ad ba 2e 91 5d f7 f8 fc 2f 2e 08 0c 05 2d 10 cb 3b 06 98 1d f4 74 28 7c ad 01 90 38 0f 82 c0 8c 3a 64 3d e0 88 37 cd 52 3c 5c 2f 1a a2 61 38 59 1f e8 a2 09 c1 c3 82 e7 2e c5 0d 40 05 bf 31 7c fa 99 c7 61 e2 fd b5 5f c2 cc 86 7a bc 03 29 04 48 de 3b 17 33 5b ed 07 b6 6b ae 33 d9 44 f5 54 bb 73 28 b8 f2 3b a5 80 61 47 62 f0 20 50 af 13 35 94 75 9c 58 11 36 11 47 6a 09 3c 6e 81 23 b4 d7 51 bc 7d 25 12 23 c2 57 1c 22 7a db 4c 30 b4 9c 01 3c 33 39 df 61 14 5f 82 d6 bf f3 fb 42 3f ae de 1c cb 72 e2 02 f0 e6 50 01 67 28 b1 c1 39 50 12 e6 86 f4 bf 7d e7 64 b0 25 72 80
                                                                                                                                                              Data Ascii: oXN1C(FD{%"<V/HT=3""gD}F<.]/.-;t(|8:d=7R<\/a8Y.@1|a_z)H;3[k3DTs(;aGb P5uX6Gj<n#Q}%#W"zL0<39a_B?rPg(9P}d%r
                                                                                                                                                              2024-07-18 19:38:20 UTC16384INData Raw: c5 35 d6 57 2b a5 b2 76 1d 3d c4 13 c0 7d b3 fe 89 5c d2 5f 6d 86 58 96 23 a6 ed ef 18 e5 4a 1e f7 9a dc 15 05 6c 25 e2 c5 66 fa 48 77 cd d7 bc 04 e2 6d 44 e8 e0 95 58 ac cc 78 28 32 c2 ac 5d 90 ea f8 39 f9 db 49 43 8e 8f 12 3b 45 d6 45 67 35 cb 76 59 82 30 54 b4 a5 b1 fc 87 00 19 5f fd 84 82 fe 52 ea 63 2b a8 64 28 c3 7c 42 7b 12 c3 e6 36 f0 1f 3f f0 8b 99 3b bf 9c e8 32 39 9c 54 5f a5 65 90 cc 1b 85 92 28 07 59 4e fd 71 17 4c 91 51 c7 9d 62 99 49 b0 ae de 7d f6 eb b5 59 34 8a 17 f5 2b b5 bb fb b9 ce da 73 6a 28 b4 be 99 7d 92 5d 39 77 eb 42 ea 15 ce 46 42 00 de 60 7d 2f c1 dd a4 04 3f db 84 16 af cd 75 1e d2 2d 7a 5f db 32 8a 09 b8 b7 8a a0 ba 59 cf 3c 8e 3d 65 83 bb b7 fb 0b 78 b0 ac 6f 91 43 b3 22 81 6d 98 8d ae 28 f8 e4 ca e2 01 45 81 d5 65 5f 0e 97
                                                                                                                                                              Data Ascii: 5W+v=}\_mX#Jl%fHwmDXx(2]9IC;EEg5vY0T_Rc+d(|B{6?;29T_e(YNqLQbI}Y4+sj(}]9wBFB`}/?u-z_2Y<=exoC"m(Ee_
                                                                                                                                                              2024-07-18 19:38:21 UTC16384INData Raw: b1 47 24 6f e2 ca 38 00 13 9c 4b 9a 9b a7 b4 3d 73 5f 53 cd 4e d9 11 9c 90 3b 62 bb 87 59 a7 27 9a 00 14 90 7d ac 83 eb 35 dc c7 9d 67 28 e0 07 3e ff 31 7c ec 7d 5a 82 3f 85 d2 cd ed a9 54 be 3d 01 9e 38 0a 54 ca cf 2c 75 87 cb 15 ca c2 11 10 e2 2d df fb 88 c2 2c c3 95 40 1d a1 8a e7 b2 e9 4d 60 b5 48 79 1b 4a 50 94 b1 19 6d 4e cd 92 e2 9d eb a0 b4 af 14 f2 6f 40 40 3f d5 b9 71 5a a5 d8 a9 9d cc 73 8a 08 ab 12 4a 7a a5 39 98 0a 9e e9 0c 6c d5 26 13 a4 e6 ee 07 69 0b e5 cc d1 6f a0 dc ea 2c 04 6f 96 50 fe 23 af 50 fc 86 9b e0 03 94 0b ee 59 96 9f 8a bd a6 95 a5 ec c2 9c dc 98 bf 6f 65 15 cb e2 f7 d1 9c b7 9e 5a 0c e2 50 c7 ad 13 90 37 48 06 67 ec 60 f7 cf 3f 77 6d 21 0f 79 9c c0 ec e4 a0 53 e1 74 d4 2b 13 ea ee 3d 01 3e 72 2b e2 eb 8a 55 44 9e 54 d7 6a d6
                                                                                                                                                              Data Ascii: G$o8K=s_SN;bY'}5g(>1|}Z?T=8T,u-,@M`HyJPmNo@@?qZsJz9l&io,oP#PYoeZP7Hg`?wm!ySt+=>r+UDTj
                                                                                                                                                              2024-07-18 19:38:21 UTC16384INData Raw: a1 93 3d fc 5a b0 ce 0d a6 1f c8 7c 88 bd 9d f6 60 ae ce 72 c3 60 97 74 05 eb 87 32 4a 35 41 04 7e a3 0e 32 85 b6 da cf b0 6a 5c a2 63 23 0e 49 86 d0 41 2d 8f 1d 49 cb 9b d0 52 82 ac 32 f4 22 70 d2 31 93 e4 10 7f 0c 9c 68 0c 94 ea 87 39 47 d8 1b 29 19 95 58 3c f9 78 ea cf 60 d6 b9 bd a2 a7 24 b8 a4 46 4d bd c5 34 2a 8e 02 3c 8d f5 b6 d5 20 d4 50 11 28 a9 fb 5f e7 b0 be d0 5f 60 a0 7e ef 9b 1e 72 c6 5f b3 99 c9 ce 62 8e 5a 4e 2a d8 b7 b6 21 ad 9f 75 ce f9 82 80 5c 4e 93 2e 2d 42 e3 aa d7 f8 6d 18 e6 c3 d6 ef f0 65 4e 74 21 e7 24 56 d8 6c 0c 56 b3 10 47 c7 2b 44 5b 82 bf 3c a4 af 88 6f 1a 72 e6 c2 54 67 e9 57 c7 c3 39 dd 83 c5 02 ae b2 c1 f4 d5 3f 1f 51 73 b5 a4 7f 73 1f 30 31 c5 56 7a ff 47 c2 06 ae 37 5e a0 fc 3c 31 e4 a8 d9 aa ba e4 92 4c f7 ef 71 2e f1
                                                                                                                                                              Data Ascii: =Z|`r`t2J5A~2j\c#IA-IR2"p1h9G)X<x`$FM4*< P(__`~r_bZN*!u\N.-BmeNt!$VlVG+D[<orTgW9?Qss01VzG7^<1Lq.
                                                                                                                                                              2024-07-18 19:38:21 UTC16384INData Raw: e5 41 85 76 3c ee 5c 57 ef 96 cd 05 84 bb 64 80 38 2c 47 a5 4f 82 18 aa 1f b4 b2 f5 7e 89 69 bb c9 fb e3 f4 aa b8 f9 c5 3d 14 f0 e2 9c 95 d8 a0 92 bd 5e a3 f4 28 47 bc 91 4e 02 d7 b1 b9 23 71 0c ca 54 30 10 87 7f f2 51 84 3c 17 36 02 36 1a b4 a8 7f 05 85 a5 46 99 90 e0 b9 cb c6 d6 04 ff 21 ae 94 7e 84 fb 49 33 3e a6 d6 c8 8a d7 6e b1 5b 47 a4 2c 0a 04 48 7a 20 ef f8 2f d3 b0 99 7f 9e 32 0b dd b4 2f 05 63 b0 74 87 a0 de 33 96 43 d3 01 a5 bc a5 4e 14 c9 2d 64 76 ab 54 be 48 ba 84 b5 68 8e e7 1e 52 dd bd 77 1a f2 86 49 37 70 c4 c5 10 b8 26 df 05 5a d2 b6 7e 28 bb c5 f0 09 6a 00 b7 50 18 a5 39 dd b7 7c 60 52 45 a8 8c a0 7c 82 d0 89 3f 24 7e c8 fb 75 dd ae 32 2f 4d 5b 1e 6f e4 4e 44 21 95 1f 63 50 09 9f 61 44 5d d6 ac 53 61 7f a3 12 ae 6d c6 9a 18 8b c2 3e 72
                                                                                                                                                              Data Ascii: Av<\Wd8,GO~i=^(GN#qT0Q<66F!~I3>n[G,Hz /2/ct3CN-dvTHhRwI7p&Z~(jP9|`RE|?$~u2/M[oND!cPaD]Sam>r


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              4192.168.2.44974513.249.12.1254436740C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:38:43 UTC142OUTGET /f/WebAdvisor/files/1489/saBSI.zip HTTP/1.1
                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                              User-Agent: Inno Setup 6.1.2
                                                                                                                                                              Host: d11iilsblp9z11.cloudfront.net
                                                                                                                                                              2024-07-18 19:38:43 UTC628INHTTP/1.1 200 OK
                                                                                                                                                              Content-Type: application/x-zip-compressed
                                                                                                                                                              Content-Length: 527389
                                                                                                                                                              Connection: close
                                                                                                                                                              Date: Thu, 18 Jul 2024 16:36:17 GMT
                                                                                                                                                              Last-Modified: Tue, 26 Mar 2024 13:11:30 GMT
                                                                                                                                                              ETag: "f68008b70822bd28c82d13a289deb418"
                                                                                                                                                              x-amz-server-side-encryption: AES256
                                                                                                                                                              x-amz-meta-cb-modifiedtime: Tue, 26 Mar 2024 13:10:42 GMT
                                                                                                                                                              x-amz-version-id: 7sn0EuMWH3aYiKrbA4lOPgyoNDAU9iIf
                                                                                                                                                              Accept-Ranges: bytes
                                                                                                                                                              Server: AmazonS3
                                                                                                                                                              X-Cache: Hit from cloudfront
                                                                                                                                                              Via: 1.1 4d3c039385e1d4ab0e1d024dacb2fd62.cloudfront.net (CloudFront)
                                                                                                                                                              X-Amz-Cf-Pop: CDG53-C1
                                                                                                                                                              X-Amz-Cf-Id: ppAmZxfMiSnZqMRzgrxLm8lorqEECe9OaNwjS4Kbgh60ymejiRep4Q==
                                                                                                                                                              Age: 10947
                                                                                                                                                              2024-07-18 19:38:43 UTC16384INData Raw: 50 4b 03 04 14 00 00 00 08 00 9b 5c 7a 58 1c 99 c3 c5 a9 0b 08 00 80 11 12 00 09 00 00 00 73 61 42 53 49 2e 65 78 65 e4 5a 7f 70 54 d7 75 be 2b 69 a5 d5 8f 65 57 20 63 d9 c8 f1 da 26 8e 9a c1 92 6c a1 09 13 8b c9 82 59 5b 06 01 8b 2d 40 60 01 c2 08 f1 90 65 90 b1 b0 e5 16 3b 72 05 54 ab 95 1c 4d 4a 33 b4 61 dc 5d ad dc 68 3a 9a 56 46 3f d8 75 15 b3 c4 54 12 1d 1c 2b ad 9a 28 29 d3 ca 89 3b f3 1c d4 76 93 12 5b 76 15 d4 f3 9d fb f6 bd dd d5 92 e0 bf b3 03 f7 5d 9d f7 9d ef 9e 73 ee bd e7 fe d8 dd bc bb 5b a4 0a 21 d2 e8 ff c2 82 10 41 21 3f 4e f1 fb 3f 25 26 21 96 dc fb ce 12 31 94 f9 fe 7d 41 53 e5 fb f7 55 29 87 5f 74 34 1d 3b 7a e8 d8 fe e7 1d 07 f6 1f 39 72 b4 d9 f1 ec 41 c7 b1 e3 47 1c 87 8f 38 36 6c 7d da f1 fc d1 ba 83 45 56 6b d6 4a 8d e3 11 db 87
                                                                                                                                                              Data Ascii: PK\zXsaBSI.exeZpTu+ieW c&lY[-@`e;rTMJ3a]h:VF?uT+();v[v]s[!A!?N?%&!1}ASU)_t4;z9rAG86l}EVkJ
                                                                                                                                                              2024-07-18 19:38:43 UTC16384INData Raw: d4 86 29 b5 21 4a 6d 20 dd dc 3f cd bc a4 c3 4c 4d cb 4b 26 b6 e9 52 33 78 49 ff 71 23 35 c9 4b 06 78 6a cd 94 5a 13 a5 16 48 b7 3c 4c 33 2f 59 bc 4d a6 a6 e5 25 67 68 53 33 78 c9 3b 8f 19 a9 49 5e 32 cc 53 eb a5 d4 7a 28 b5 70 ba 15 64 9a 79 c9 eb 7b 65 6a 7b 1c 9a d4 ca 7a 75 a9 19 bc e4 da 01 23 b5 f4 bc e4 90 e4 25 87 38 2f 39 2c 79 c9 84 e0 25 4f 1d 4b cf 4b 36 6e c5 1b 5b 2c 42 ff b2 35 cd 22 f4 e7 37 31 8d fb 3f 9f 99 81 97 cc f1 08 5e 32 b6 d1 d8 1d 66 67 3a 73 d9 8f e4 a7 5b 52 79 49 57 a7 b1 1d 8c ab bc b8 ea 95 2d 13 f3 92 0b 3d 82 97 6c 31 6c 7d b0 bd 1e b6 2b b6 68 f7 63 06 b7 f2 e5 8c 78 c9 80 47 f0 92 8d 78 12 e0 3d 9d c2 4b 26 3a b1 e3 0b c9 79 5b d0 20 b6 fd 12 85 97 f4 75 19 54 83 07 fb 25 4d 30 b9 62 8b 6d bf 64 11 f9 27 5e 32 2c 9f e7
                                                                                                                                                              Data Ascii: )!Jm ?LMK&R3xIq#5KxjZH<L3/YM%ghS3x;I^2Sz(pdy{ej{zu#%8/9,y%OKK6n[,B5"71?^2fg:s[RyIW-=l1l}+hcxGx=K&:y[ uT%M0bmd'^2,
                                                                                                                                                              2024-07-18 19:38:43 UTC16384INData Raw: be cb 8f ff db b1 fd 37 c7 f5 ff ed c1 e3 9f fc 7f 35 fe cd 38 fe df bf cc f8 ef 55 c7 ff 6d 65 fc c7 c5 8f 7f 91 9a 74 6a 6e 34 36 6b 16 71 58 31 9b 20 e8 85 96 62 57 65 0d aa 33 c0 78 40 4c cd 72 d1 94 71 c0 23 e1 a7 cd 15 12 13 3d 21 d1 1c 12 8d 85 c5 54 07 fa 22 79 c6 86 7e 02 ff de 34 d2 0c 7c 2f bd 8d ea 27 28 4e e9 c4 18 7a cb a8 9f 8e d8 fe d3 24 4c 57 d5 80 db f8 ab 2c 92 63 37 62 fa 08 a8 67 a0 3f b1 2d ed f8 e3 42 3d 4a 88 64 b5 65 62 8f bd 47 34 60 82 d0 d6 a0 9e e4 25 92 02 ab c7 ed 42 cb d6 1f 31 ae 0b 24 e3 56 c9 b9 77 c3 25 2e 09 04 ca d9 67 4c 66 a7 d5 94 dc 68 9a 9f b0 b5 17 f3 44 df 95 50 0d df ab d2 64 47 1b 2c 5f 67 4c 63 8c 36 ba a4 1e 40 73 b4 bd b5 f5 29 0d f7 0b dc 5b d4 f4 97 f6 94 a6 ff 68 f8 b9 c8 71 18 1f e9 dc ab 03 e9 d6 df
                                                                                                                                                              Data Ascii: 758Umetjn46kqX1 bWe3x@Lrq#=!T"y~4|/'(Nz$LW,c7bg?-B=JdebG4`%B1$Vw%.gLfhDPdG,_gLc6@s)[hq
                                                                                                                                                              2024-07-18 19:38:43 UTC15289INData Raw: 2c 4f 70 8b 5b 6b f0 7c b9 b7 3e e8 ed 54 4e c9 3b 32 13 c7 fb fc 8b b1 ac e3 dd 05 31 10 01 6b c2 f8 f7 5c 88 7f 31 93 2b f7 f3 9a e9 41 aa 58 58 7e 2b eb 59 bd d2 eb 57 b0 b6 5f b4 b8 cc ea 37 56 7a 9a ff fc 44 38 00 85 8e b7 ac b0 1c 87 01 b6 7c 27 4a 69 91 96 36 a0 44 7d 5c 61 97 40 5e ef d5 6c fd dd 78 6e 5a b3 95 b8 f9 86 ad a1 e5 ef 1c 56 07 8b 40 84 51 26 64 e5 ba ec d4 44 84 b7 49 c4 08 c0 ed e0 f2 46 21 2c 53 ba b9 1e c0 63 33 15 2c 19 97 71 48 5e fe 10 58 dc 22 f6 b8 23 e3 a4 bc b4 08 ae 65 2f 4e 00 58 ed 70 31 db c7 76 3a f7 38 6b b0 58 22 9d a0 3d e4 dd 23 67 1c 78 c2 c6 0e e8 10 0e cd 19 c7 9e 48 f8 38 68 40 38 88 9c 7b ec d9 5b a3 af a7 f7 f4 58 41 c7 d3 de 4a e1 cb e6 0a ba 0b e5 72 ea 4d de 23 1d 6a 96 b9 82 4e 17 bf 33 2a 6b 80 71 7b 71
                                                                                                                                                              Data Ascii: ,Op[k|>TN;21k\1+AXX~+YW_7VzD8|'Ji6D}\a@^lxnZV@Q&dDIF!,Sc3,qH^X"#e/NXp1v:8kX"=#gxH8h@8{[XAJrM#jN3*kq{q
                                                                                                                                                              2024-07-18 19:38:43 UTC16384INData Raw: 21 ce 56 99 4a fa 6b 14 e3 1d 9e 45 4c a8 0a f6 ed eb c4 63 51 e8 dc fd 9d 02 8e 42 37 d4 10 0d df a9 38 cf 20 df 29 b3 ec c7 f3 38 02 44 56 23 3c 95 9f 69 64 d7 c3 84 ca c5 1e 1e 00 cd e0 e6 06 bd 1d ff f7 71 15 30 63 28 62 a3 32 a1 26 49 46 fb 2a ca 73 57 68 8a 51 e1 1e 01 57 aa ba b9 bf 42 14 2f 63 a8 44 ad b1 d7 e8 0d 6c 92 43 25 61 8a ad 19 59 2b db cd fc 58 bc ca e4 6b 4c 75 4d 37 ea 6f a7 fa b1 3b 36 21 43 48 ad 08 85 62 62 b7 e1 de c2 74 86 6b cc de 5c 98 a6 78 32 5c ba c0 12 a6 28 f3 49 77 1f f9 6d 71 70 d4 06 9a d0 60 c9 5d f2 2a fa ba 73 74 d6 ae ac c6 f0 6d 82 0e 34 57 cd b3 b3 21 00 b7 94 d6 da bd 79 08 f7 9a 28 b8 b7 56 ae fe 03 f4 f7 a4 df 45 81 b6 7c 1f d0 16 41 8c d8 3a 98 58 42 af c6 b0 05 d1 af 9c 3d 4f 10 8c ac bd a0 13 f9 db 17 18 ea
                                                                                                                                                              Data Ascii: !VJkELcQB78 )8DV#<idq0c(b2&IF*sWhQWB/cDlC%aY+XkLuM7o;6!CHbbtk\x2\(Iwmqp`]*stm4W!y(VE|A:XB=O
                                                                                                                                                              2024-07-18 19:38:43 UTC16384INData Raw: c6 8b 54 9d 8e 99 ae c1 aa dd a1 aa 17 a5 0e 50 f5 df 2b f5 aa a3 79 d5 b6 0e 5c 3d 63 96 1e 55 d7 be 30 70 d5 e3 b1 ea bf 5e 1f d0 0a ae bd 15 fd fa f4 53 6b 66 a8 d6 0d 87 a8 56 b1 f3 3e b6 f1 a5 c8 2a 47 5c a4 ca 71 58 65 7a a8 4a ef 2d 03 54 b9 df ad 57 79 25 af 32 96 0f 1b a1 11 03 26 ff b7 6a a6 35 1b 91 cd d4 79 38 32 d8 45 67 bb 6d 7c 1e fe d8 63 da 6c d7 8b 4c c8 e5 1a 96 a5 2e 3b 11 db 6e 6c 0b 15 7e e8 52 0a f7 f0 c2 27 f2 c2 55 9e ac 23 f1 1a ee 99 8d 6e 80 60 45 2f 46 a2 f1 f0 73 03 a3 11 3d a8 b3 8f ae 03 a2 a9 fb 40 27 9a 89 e3 03 fd 13 cd f2 25 3a 2e 8f 1d 0c 1b 7e 07 85 0f bf f1 b7 68 b8 ec cb 5f dc ba 96 0e f2 f5 f4 e4 0b 91 22 fc ea 3e 81 0d 89 f0 38 04 36 0b 81 ad 0d 89 f0 f5 d7 f5 0d 2c 45 1e a9 e0 f2 fd 47 07 03 ba 0f 16 1c 99 eb 78
                                                                                                                                                              Data Ascii: TP+y\=cU0p^SkfV>*G\qXezJ-TWy%2&j5y82Egm|clL.;nl~R'U#n`E/Fs=@'%:.~h_">86,EGx
                                                                                                                                                              2024-07-18 19:38:43 UTC16384INData Raw: 9f ca f1 69 e8 3b 17 42 a7 bc 85 82 1e 0a a6 c3 ff 19 78 16 74 d1 3f 4d e4 49 1b 93 1a fb fc d5 7f e1 8e 78 54 67 94 c6 c8 b9 ad 53 3d b7 65 8a df fc 68 f6 39 4c 43 ef 7c e6 64 df fb e2 6a 0b e7 e7 ed 9f af ca 10 77 26 2b 33 8b 7c 1d 5a 8c b0 f0 29 a4 8c ad f6 dd 2e 78 f5 20 42 b6 c3 2e 15 c7 70 b9 4b 59 a8 8e 97 37 d6 ba 04 5a 77 25 cc c0 10 93 8d fc 21 b1 01 55 7c e8 99 b3 b5 4f 5f 20 ee c4 40 16 a6 4d a8 06 72 d5 24 97 87 26 0e 60 fb dd 20 dd 2f 28 2d 8f 00 7b 5b 2c b0 d9 98 a1 82 69 51 c1 1c 0f e0 58 86 01 98 8c 00 4a 96 32 06 86 83 7e 89 3a 97 21 7f c8 cb 24 e5 20 41 39 bc 02 98 5e f8 44 d9 77 b8 bd ed c5 e3 1f 68 94 15 cb 78 18 86 67 36 3d 82 2e f0 9f 09 07 61 b9 69 b3 52 b2 9d 76 1a 04 96 c8 8b 18 62 8a a0 37 fc cd a4 68 1b cf da 26 b0 ac 6d 11 07
                                                                                                                                                              Data Ascii: i;Bxt?MIxTgS=eh9LC|djw&+3|Z).x B.pKY7Zw%!U|O_ @Mr$&` /(-{[,iQXJ2~:!$ A9^Dwhxg6=.aiRvb7h&m
                                                                                                                                                              2024-07-18 19:38:43 UTC14808INData Raw: 58 b8 92 49 66 1b 23 a6 04 e5 82 19 88 22 28 0a ba 81 6f d6 97 17 e2 1d c5 f6 52 5d 19 ae 04 3a 00 2d ca 84 17 ab 95 f9 a1 2c 36 d2 ac 4c 5e d2 b4 f6 bf 1a 69 f7 bf 3e e4 fc 26 eb 8b b5 93 cd 1b f9 7d 06 f9 e3 c5 fa e4 49 36 af 08 d0 ca 63 23 41 50 3c d1 a4 be d8 e4 35 2b 5d 56 bf a6 f8 cf 07 fc ff fb 3a d0 b3 07 df c3 50 83 c7 2d 1f 90 43 7e 71 42 ee a1 43 3e 91 13 03 63 ed 8c 0b 3a 71 73 e6 36 c8 c1 8d 8b 71 b5 10 3e a8 af 17 b1 72 e7 c4 66 50 00 3e 9e d4 6f 33 24 e0 1c 63 48 a7 40 8f d6 07 8a 41 18 82 c8 b1 05 e1 8a 02 fe 5f 93 ec 25 74 c1 b2 30 c3 16 8b 69 b3 bc 80 ad c9 8f 98 c1 ab 16 7c e5 c2 f2 42 c0 64 49 3c 2a f7 5d 10 15 c2 1f fd 1d a8 93 ad 24 7f 45 ac 8e 84 65 9e c5 54 87 e0 c1 85 f6 2a 49 35 6f 61 62 95 24 ba 24 ce c1 8b f3 6f 59 29 10 75 48
                                                                                                                                                              Data Ascii: XIf#"(oR]:-,6L^i>&}I6c#AP<5+]V:P-C~qBC>c:qs6q>rfP>o3$cH@A_%t0i|BdI<*]$EeT*I5oab$$oY)uH
                                                                                                                                                              2024-07-18 19:38:43 UTC16384INData Raw: 27 5a 51 80 48 86 d7 ca d2 c2 d0 d8 d4 21 7f e5 aa c4 21 6f 1f 90 0f 64 95 4a f5 fc 85 ef f4 9b 81 11 52 4e 3d ff dd 77 52 fc fd 9b 9e 88 8d c7 b4 c7 cb d1 d3 8f 67 a9 ff 2a a1 bf 2d a7 e4 0d 76 16 ef de 1d c3 7a d5 9d f3 32 8c 15 78 a9 dd 87 59 99 6d ea ce 68 66 1b 3b 87 db 05 3e c2 c5 01 8f 8b ed d1 47 02 c1 96 e3 95 39 ba 8b 55 e5 8a f3 8d ac 84 8c 7a a9 e4 18 9b fc 18 24 17 30 d0 cb 15 d0 7f a6 96 3b 43 d3 d9 08 16 8d c5 4b 1f 59 03 b6 e3 15 35 91 37 82 79 35 0c 26 40 b7 37 23 a4 e2 6e f9 26 19 5e 86 de 2b 69 ea ca a2 fd ef 80 d0 58 0c 6c f5 1e 5b 81 f3 e6 8e 92 64 db 9c 1c e3 4c cb d5 f3 93 0e 0b 5b 59 82 50 1b 1e 88 0f da 6f cf cf 18 e0 41 f5 f2 df e5 c6 09 ef fa 3a 52 c4 82 77 01 df b5 a4 e5 bb 7b 46 db 7c a7 02 49 14 3b 70 ee ba f3 c8 7a 2b ff c9
                                                                                                                                                              Data Ascii: 'ZQH!!odJRN=wRg*-vz2xYmhf;>G9Uz$0;CKY57y5&@7#n&^+iXl[dL[YPoA:Rw{F|I;pz+
                                                                                                                                                              2024-07-18 19:38:43 UTC16384INData Raw: 8d 07 f9 6c fa f8 68 1a 2b 19 18 ef 92 5d 37 c3 b3 8b 27 79 ec 4a b6 8f e0 ca aa 49 db e1 d5 ed d1 e2 8f 9d d0 e2 8f 4d dd 68 d4 39 f9 4f 2d 02 d8 92 83 c6 60 fa 1c 07 7d 85 1d 4a a7 a1 bd 2d 1e 08 9b 79 8a 83 56 a0 cd 27 f3 a0 93 8c a1 15 d9 e2 92 af b5 36 a2 01 d2 f0 88 ca a5 7f 41 be cd 7a 94 49 52 b5 ac 71 e6 4b a9 3f 42 3f 3b c5 30 a8 7e d6 63 e6 e1 c8 60 f5 66 7d 82 75 76 67 07 b6 0d f6 ba 67 b5 5d 47 f9 1b 8c 7b 44 46 38 73 06 83 c0 09 95 78 b7 75 12 7e 94 04 de 4a 6f cf 53 42 25 7a 35 d6 e2 b3 61 ff d7 1b b5 2d e3 0c 18 6a df be b3 41 7d 8c 82 af 3c 4c 5a 46 1d ec a2 b5 84 83 3d 39 7e 5f fb 59 ae a4 71 90 3a 85 e5 73 d0 db 7f 89 aa 18 7c af 41 c1 a2 eb 2e 5e d4 ef db 7c 36 b8 57 aa d5 de 30 da a6 6f 8f 06 62 d0 f8 6b 58 8e d2 eb 11 2a be d6 98 19
                                                                                                                                                              Data Ascii: lh+]7'yJIMh9O-`}J-yV'6AzIRqK?B?;0~c`f}uvgg]G{DF8sxu~JoSB%z5a-jA}<LZF=9~_Yq:s|A.^|6W0obkX*


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              5192.168.2.44974613.249.12.1254436740C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:38:44 UTC136OUTGET /f/AVG_AV/files/1319/avg.zip HTTP/1.1
                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                              User-Agent: Inno Setup 6.1.2
                                                                                                                                                              Host: d11iilsblp9z11.cloudfront.net
                                                                                                                                                              2024-07-18 19:38:45 UTC545INHTTP/1.1 200 OK
                                                                                                                                                              Content-Type: application/zip
                                                                                                                                                              Content-Length: 125405
                                                                                                                                                              Connection: close
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:38:46 GMT
                                                                                                                                                              Last-Modified: Tue, 17 Oct 2023 08:25:24 GMT
                                                                                                                                                              ETag: "56b0d3e1b154ae65682c167d25ec94a6"
                                                                                                                                                              x-amz-server-side-encryption: AES256
                                                                                                                                                              x-amz-version-id: 7L8o.GLX1Vn.tHqh_TFMmsecTIZweR8e
                                                                                                                                                              Accept-Ranges: bytes
                                                                                                                                                              Server: AmazonS3
                                                                                                                                                              X-Cache: Miss from cloudfront
                                                                                                                                                              Via: 1.1 b59465a36dda3b4ec573f7a87861306c.cloudfront.net (CloudFront)
                                                                                                                                                              X-Amz-Cf-Pop: CDG53-C1
                                                                                                                                                              X-Amz-Cf-Id: oVcXlrXhg-Uq9tTZ7o8-Eeuhi2fk5pOiR6jiFtMwpTSl0pQOKBfjfg==
                                                                                                                                                              2024-07-18 19:38:45 UTC15345INData Raw: 50 4b 03 04 14 00 00 00 08 00 c5 58 51 57 d0 61 0b d8 1f e9 01 00 b8 95 03 00 1c 00 00 00 61 76 67 5f 61 6e 74 69 76 69 72 75 73 5f 66 72 65 65 5f 73 65 74 75 70 2e 65 78 65 e4 5d 7f 7c 54 47 11 7f 97 1c c9 95 1e bc a3 4d 6a da 52 48 2d 56 ea d1 36 10 40 e8 01 0d 81 03 5a 09 bd 10 b8 a0 25 40 2d 8d e7 89 1a 93 3b 40 4b 28 e9 e5 2c cf c7 53 54 50 54 aa 54 ea 47 54 d4 a8 89 a4 48 e8 25 c1 fc 2a 42 42 51 d2 82 36 5a d4 97 26 da b4 a4 e1 80 34 e7 77 66 df fd 08 bf ac 1f fd 4f 5a ee ed db 9d 9d 9d 9d 99 dd 99 9d dd 7d e4 7d 6c bb 94 2c 49 92 19 7f 23 11 49 aa 95 c4 9f 1c e9 df ff c9 34 49 d2 e8 f1 07 47 4b d5 37 fc ee ce 5a d3 e2 df dd b9 cc f3 c9 b2 cc 92 d2 cf 7e a2 f4 b1 4f 67 3e fe d8 67 3e f3 59 5f e6 c7 9f c8 2c f5 7f 26 f3 93 9f c9 9c ff 48 41 e6 a7 3f
                                                                                                                                                              Data Ascii: PKXQWaavg_antivirus_free_setup.exe]|TGMjRH-V6@Z%@-;@K(,STPTTGTH%*BBQ6Z&4wfOZ}}l,I#I4IGK7Z~Og>g>Y_,&HA?
                                                                                                                                                              2024-07-18 19:38:45 UTC473INData Raw: aa 3e a1 da f4 72 6d 36 e9 b5 11 33 3f 56 fd cd d8 43 b3 d4 b6 7d 15 1b f8 3b 7b a4 cf fc 44 e5 30 75 b8 5f 68 f5 10 37 02 0f 5f 91 a1 01 3d f8 fe 91 9f 8c 47 7d 0a 4c 68 71 07 29 59 bb 83 44 37 92 c4 07 75 d2 b2 2b f9 36 94 a1 e4 d9 43 f9 76 dc 91 90 b7 91 e2 f9 8b 00 45 c0 45 77 77 fc fd e1 c5 56 fc c5 00 82 bd 6a 91 7a 1f 08 88 a1 51 e9 37 8b 1f 03 31 86 39 70 87 16 db 69 e5 18 68 4d a2 32 e8 72 f2 df c2 bc 64 10 a5 91 eb e4 12 a7 5d 22 50 cc 2c 11 88 f6 ef ca ef c0 85 73 ac ad 66 c6 2c 1e ab e3 28 c3 bf 78 f7 91 aa eb 8c f7 91 9c 5e f1 e3 b0 f1 3e 92 b4 bf 6d 8c da df 62 56 0e eb 5f d0 86 1b 1c 45 65 36 8f ea d7 19 9e 68 41 a9 26 65 28 34 e3 3a d9 85 db 00 a5 4a 19 e2 52 1f bc 97 48 e0 19 b3 68 58 c2 7d 66 93 b0 3c 65 43 54 f6 99 37 1d b5 d2 24 5a bc
                                                                                                                                                              Data Ascii: >rm63?VC};{D0u_h7_=G}Lhq)YD7u+6CvEEwwVjzQ719pihM2rd]"P,sf,(x^>mbV_Ee6hA&e(4:JRHhX}f<eCT7$Z
                                                                                                                                                              2024-07-18 19:38:45 UTC16384INData Raw: 52 61 09 80 f1 8f 5f bf 5c aa fa 3c aa e9 af f1 83 2a 15 93 90 a9 e1 ab d8 b1 ac c2 25 03 e9 4f 47 34 6d 51 e9 9e 96 6b 68 c9 93 42 19 d0 5b f2 a4 47 4c 18 4c b1 af f4 0e 86 df a1 f2 cf 8a 29 de d2 bb 11 c3 4c 08 0f a5 57 72 3d f2 db f3 70 63 49 f3 6c fc 06 d5 b7 48 0e 58 4c 80 46 fc 45 9d 03 95 03 26 00 13 35 ea fd 32 98 f2 20 1c 7b 5f 4f 79 59 bd ae 27 3d 91 b7 e6 5a e5 c3 46 8f 8c fe 8a 72 79 2d 6f 2d 9e ea 95 ba fc 2b 49 f3 de ea c8 6b f2 88 b7 42 d1 2b 75 cb a2 57 ea 46 f8 c4 21 a4 b0 1f 9e 50 ae 55 b1 e0 e6 45 ae 0d ed e8 55 32 a9 39 f1 43 bf dd 05 c4 74 d5 ce 2b ae fd 25 01 a7 e1 1e 07 a0 57 96 68 17 82 f7 ec 45 77 9b 0f 9a 24 3f a9 31 f0 13 39 df 7b a3 f3 dd 3b e4 ea 36 d8 07 7c 8f 99 d5 56 41 77 25 79 84 db 8e f8 24 44 99 65 94 0d 1d 2a b2 11 69
                                                                                                                                                              Data Ascii: Ra_\<*%OG4mQkhB[GLL)LWr=pcIlHXLFE&52 {_OyY'=ZFry-o-+IkB+uWF!PUEU29Ct+%WhEw$?19{;6|VAw%y$De*i
                                                                                                                                                              2024-07-18 19:38:45 UTC16384INData Raw: 0e 02 d9 7b d3 b3 f1 f4 b6 0e a5 47 78 8d 30 55 1e 60 5f 8d c6 83 0d 0c 23 e3 37 df 48 00 1b 86 e2 8f 08 ff 2e 0f 6f 78 3f fc d7 46 79 f0 25 f0 a3 5c e1 42 b3 34 7e f6 71 94 82 2e 55 2a 93 52 e8 56 a5 75 89 bc 50 71 8c 98 fc c2 4b 7b 80 95 91 e6 54 55 cf 5e 12 02 ee f1 b3 6d 60 15 3e 77 51 78 0d 85 67 ef 33 c3 2b 28 7c 1f 5d 18 db c5 af d1 5f e1 af ba ff d7 10 72 3e 0b 79 8e 9b cb a2 9d fb 5c 14 94 88 a0 e8 54 38 39 c0 e3 04 d0 11 03 f0 0e 8f 7b 94 82 9e 88 05 4d a7 a0 3f 23 bd 7d 33 c8 75 9c 5c d9 e4 ea 20 d7 2c 72 b5 92 6b 0e b9 7e 4d ae 4c 72 3d 46 ae 79 e4 fa 21 b9 3c e4 fa 0e b9 32 c8 f5 15 6e 07 2e 10 b2 b1 9f 43 74 9c 9d 4a 26 ee c5 75 9b e1 bc 6b 0b 31 27 58 07 7c 70 c9 6e 22 b7 4f 41 7d 0d 4a 79 9b 8e bf ca ae c4 ca 5a e5 1d 93 6f 61 0d 0e 40 ff
                                                                                                                                                              Data Ascii: {Gx0U`_#7H.ox?Fy%\B4~q.U*RVuPqK{TU^m`>wQxg3+(|]_r>y\T89{M?#}3u\ ,rk~MLr=Fy!<2n.CtJ&uk1'X|pn"OA}JyZoa@
                                                                                                                                                              2024-07-18 19:38:45 UTC2048INData Raw: c8 8c cb ff 2d 95 ba 1b 54 a5 4d 93 90 3a bf 2a ef 1a df 80 77 72 25 9e f8 28 e7 02 a1 cf 82 f1 04 df 68 1e f7 7d 13 22 05 d8 64 c4 c2 16 80 fd fe c2 10 1a de c3 b4 d4 62 54 0e f7 e3 99 68 04 da d4 22 7f 84 ca 50 3b ae 42 4a d9 c6 ab 35 89 aa e5 9b 90 57 d1 ef b3 89 d4 26 9e 1a 00 8f af c5 14 44 47 a2 49 f8 02 29 34 fd 1b 6d 3f 97 e0 13 aa 0e ba 75 c8 8c ed 3f 6e c3 af 1f c6 c7 f9 6b 68 ae cf f3 f8 f7 e2 ac 23 df ac 1d 03 72 9a b3 13 c2 b7 7f 2a 49 83 cf e8 ec 61 e7 d9 75 94 64 82 2a 5d 03 27 6f 6c e3 55 18 0a b2 86 f0 cf b1 42 35 b6 9d 0c 1e e9 12 67 e7 88 fd 34 8f f5 93 d1 66 32 0c e4 f6 b0 31 b9 62 fb 94 2d 28 42 bb ca cd 72 0c dc a1 94 78 bf c8 b5 83 52 6f 3d 81 1f 76 7a 17 4e 9c 90 17 0c a1 b1 48 e2 66 4d f4 50 88 27 13 c5 4a d0 3c 9a 6b dd 6e 8f fd
                                                                                                                                                              Data Ascii: -TM:*wr%(h}"dbTh"P;BJ5W&DGI)4m?u?nkh#r*Iaud*]'olUB5g4f21b-(BrxRo=vzNHfMP'J<kn
                                                                                                                                                              2024-07-18 19:38:45 UTC16384INData Raw: c8 37 95 8e 7b 7e 46 6f 9c 4f a9 03 09 6c e5 ee f0 b5 7f 7c 90 eb 70 5d 4c 4a 03 48 97 c4 56 20 0d 2c 72 5a d8 8d 3c 31 46 8f 6f e9 dd b4 5f de 09 93 64 ec 7a 0b f9 85 a0 c4 97 62 b3 8c 75 ed 9c a8 1b b3 0c 6f 99 bd a4 18 af df be 10 8c 88 f4 50 de 89 de c3 8e 7d 2b 06 ce 38 0b d3 20 ad b7 77 57 58 5a 0f b7 b9 05 74 95 f2 e0 66 9f 52 c6 56 2d a0 db c7 20 8e 99 10 b4 10 d3 40 25 d8 b2 20 72 f3 1f eb 1c 5e 3b 3a 7b 40 95 9c 6e b2 9a 70 e2 41 8e 1e f0 2b 7d bc 1d 8c d1 42 d7 2a 59 20 b1 e3 db 4d 18 d9 5d e1 1e 18 8b b9 16 b5 82 d1 2c 5d 07 57 32 0d ba 42 d5 c7 64 00 23 a5 29 99 7d 89 92 4f d6 f6 c2 fa 45 2f 5b 82 4e 27 e3 79 de 71 ec 21 ea ff 33 96 d5 e4 ff 10 46 77 c6 b3 df 7e 3c 2c 8c 00 24 c2 08 80 d7 58 4d ce 4b bd 66 f6 c1 ab bc 6e 08 1d c2 24 0d 77 ca
                                                                                                                                                              Data Ascii: 7{~FoOl|p]LJHV ,rZ<1Fo_dzbuoP}+8 wWXZtfRV- @% r^;:{@npA+}B*Y M],]W2Bd#)}OE/[N'yq!3Fw~<,$XMKfn$w
                                                                                                                                                              2024-07-18 19:38:46 UTC16384INData Raw: 25 2e a3 a0 d3 ef 58 29 19 81 6d cd 7d 5a be 06 4f cd f3 d7 04 76 5b 0d 3a 0f 74 4d 09 40 20 45 35 98 37 b5 06 27 c4 49 62 33 9f cd bd 48 97 35 79 53 85 47 32 52 63 b4 02 4d e7 18 cd fe 72 b2 bd 3b 98 ce 50 3d 84 87 a6 f8 75 27 e2 72 6c 6e b3 18 5b fd 6f d3 fc f1 e7 ad fe 83 48 d4 f2 b6 18 ad f0 c7 fd 36 d8 73 8a ef 1b ec ad 24 1b e9 c0 49 8c b3 55 54 9d 87 5c 03 63 ae 18 74 57 0c 2b 6a b6 6c d9 82 29 2b 44 cc c7 51 29 54 e4 a0 2c d7 14 58 c3 f4 93 56 4e b7 97 dd 1c 38 4b 86 58 46 e2 78 39 5c c9 96 10 71 45 15 e5 61 a2 e4 70 e6 3d 42 eb 51 34 aa 2b 1b 20 77 93 22 19 71 77 22 0e 84 93 1f af b7 28 83 63 ea ec 5f 82 29 7e 4e f7 ca b1 a2 c7 cc 61 29 bb 3e 25 19 67 04 db 4b 77 93 6d 22 e0 c3 f7 b4 65 22 bb fe a5 79 0a af 90 c8 d2 12 9e 25 8d ed 56 a6 f5 c9 24
                                                                                                                                                              Data Ascii: %.X)m}ZOv[:tM@ E57'Ib3H5ySG2RcMr;P=u'rln[oH6s$IUT\ctW+jl)+DQ)T,XVN8KXFx9\qEap=BQ4+ w"qw"(c_)~Na)>%gKwm"e"y%V$
                                                                                                                                                              2024-07-18 19:38:46 UTC16384INData Raw: 15 cf f4 4d 32 35 bf fd fc d5 04 ff 8c fc 3b 1d 9d 26 27 84 3f ec d2 e1 c7 a2 9f e6 d5 a9 d7 30 79 61 78 5a 41 bd d6 b1 01 0d ad fc 6a cd 9a 50 da c2 eb c3 ee f7 8f 5c fc 4b 61 a7 2f 82 02 c3 1f 9d d5 d9 cd 3e 5c 64 65 f7 ed a4 bf 2d 19 b2 5f bd 2f 6e c3 f9 8b 33 af 7c df a5 48 9d 54 b1 f0 cb a5 a5 0d c7 7d bd 67 ae 97 95 b8 03 1a de ee 36 f1 e0 ca b6 8d 1f d6 52 f5 fb e9 e4 ba 0f 33 3f 68 b5 6b ed b4 51 6b 4a 3b 1a 1d bb 4e 09 59 b1 ab a8 e1 de 82 88 ce e1 47 36 77 59 59 fc f9 d3 4d 19 9d 5b 84 77 e8 7c bc 61 ef c2 f9 4f 0d dd 2e 8c fe e2 9d 25 4e 41 bf 37 2b ed 53 f9 8d ef cd d3 33 6b 26 37 39 65 dd ec e9 8f 9f f5 de b2 71 e7 be d4 1f 14 2e bb ac d9 ce d8 b0 37 60 ea 85 cc 4a 4f ff 73 d7 26 e4 75 bc f5 b5 7d fc 60 e3 37 4d 0b b6 f6 19 d9 ee ec 89 cb d6
                                                                                                                                                              Data Ascii: M25;&'?0yaxZAjP\Ka/>\de-_/n3|HT}g6R3?hkQkJ;NYG6wYYM[w|aO.%NA7+S3k&79eq.7`JOs&u}`7M
                                                                                                                                                              2024-07-18 19:38:46 UTC12511INData Raw: e6 4f 83 4b bc c9 b6 18 73 ea b9 8e 24 91 0f c1 7c 67 26 ec ce 5a e8 cf 66 f0 df 02 fe db a8 a7 0a 64 50 83 1e f5 da 47 aa 3a e0 6f 8a be 6b 7d 1a ba 83 f1 b6 41 77 e2 15 fd 16 bc 59 c8 da 42 33 ee b7 fb bd 63 ee b6 e3 f9 cf f1 7c 2e 46 99 e2 25 21 24 59 11 c5 f3 94 ae 4a 21 e9 ea a9 24 5d 33 8d a4 6b d3 19 d8 b9 90 b6 2a 95 a4 bf 4f 26 69 6d 22 49 59 de aa 58 92 42 1e 29 da 48 8a 36 b3 44 db c8 16 06 91 6c fe 28 92 cd 1b 4e 36 0b 7d 68 80 7f 10 75 50 9a 8f f9 c2 3a 52 e9 bc 91 54 ba 6e a2 1e ca 5b a8 47 f7 6d d4 43 7d 27 f5 ec 0d fe 7a 87 49 4d 84 fa b7 3d 4d 1a 1e e0 3f 12 fc 23 ee 90 d6 94 fb 8c b3 80 a4 c7 a4 15 8f 50 fe eb e3 8c 54 0f e9 86 a9 5c 0b f1 bc 11 65 e2 45 13 ee a1 4e 5f 58 30 4e 6b d2 48 ba 2e 03 c8 22 e9 fa 6c 92 6e 98 0e e4 b0 73 20 0b
                                                                                                                                                              Data Ascii: OKs$|g&ZfdPG:ok}AwYB3c|.F%!$YJ!$]3k*O&im"IYXB)H6Dl(N6}huP:RTn[GmC}'zIM=M?#PT\eEN_X0NkH."lns
                                                                                                                                                              2024-07-18 19:38:46 UTC13108INData Raw: 88 5a 4a ad a7 3e a7 1a d3 fd e9 07 40 d5 a5 cc 39 66 3c 5b ca 2e 00 14 bb d8 03 ec 19 f6 22 fb 23 db 82 eb c8 75 e6 06 73 cf 73 2f 73 5f 71 d7 b9 ea fc 5c fe 3d fe 2a 5f 43 68 2a b4 10 08 b1 96 58 5f 6c 29 46 88 51 a2 2c 76 17 07 43 be 33 c5 09 e2 6c 71 9e f8 92 f8 b2 b8 51 dc 0a 98 3f 10 0f c1 2e 10 52 35 e9 5e c8 97 21 0d 91 5e 92 5e 91 36 c1 2a ec 95 f6 4b 47 a5 10 59 97 7b c9 f9 f2 2c f9 45 79 ad fc be 7c 50 3e 22 9f 94 6f c9 ad 95 2c 65 81 b2 4c d9 a2 7c a8 9c 51 6e 28 81 6a 4d b5 b9 1a a7 3e a2 a6 a9 e3 d4 f7 d5 3f a8 c7 d5 6f d5 7a 5a 1b 2d 46 2b d0 9e d2 56 6b fb b5 6f b5 40 68 47 0f bd 58 9f a6 bf aa 7f a1 37 36 5a 1b 8c 61 18 7d 8c 42 63 bc 51 62 2c 30 16 1b 6b 8d ad c6 0e e3 80 f1 b5 c5 8b 49 c8 e0 71 a8 46 3e 48 26 92 c9 e4 93 b0 d0 cf 91 2f
                                                                                                                                                              Data Ascii: ZJ>@9f<[."#uss/s_q\=*_Ch*X_l)FQ,vC3lqQ?.R5^!^^6*KGY{,Ey|P>"o,eL|Qn(jM>?ozZ-F+Vko@hGX76Za}BcQb,0kIqF>H&/


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              6192.168.2.44974813.249.12.1254436740C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:38:57 UTC326OUTPOST /zbd HTTP/1.1
                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                              Content-Type: application/json; Charset=UTF-8
                                                                                                                                                              Accept: */*
                                                                                                                                                              Authorization: Signature=c0ca984d9cd1b9e9ffdf6097b502a49003af5070b14ac3fa1760d15f36f3f81f
                                                                                                                                                              User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                              Content-Length: 289
                                                                                                                                                              Host: d11iilsblp9z11.cloudfront.net
                                                                                                                                                              2024-07-18 19:38:57 UTC289OUTData Raw: 7b 22 74 61 62 6c 65 22 3a 22 7a 62 5f 61 6e 61 6c 79 74 69 63 73 22 2c 22 64 61 74 61 22 3a 22 7b 5c 22 30 5c 22 3a 5c 22 5c 22 2c 5c 22 31 5c 22 3a 5c 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 5c 22 2c 5c 22 32 5c 22 3a 5c 22 32 30 32 34 30 37 31 38 31 35 33 38 30 36 5c 22 2c 5c 22 33 5c 22 3a 5c 22 42 69 74 43 6f 6d 65 74 5c 22 2c 5c 22 34 5c 22 3a 5c 22 42 69 74 43 6f 6d 65 74 5f 50 75 62 5f 42 5c 22 2c 5c 22 35 5c 22 3a 5c 22 42 69 74 43 6f 6d 65 74 5c 22 2c 5c 22 31 38 5c 22 3a 5c 22 5c 22 2c 5c 22 31 39 5c 22 3a 5c 22 5c 22 2c 5c 22 32 31 5c 22 3a 5c 22 5c 22 2c 5c 22 36 5c 22 3a 5c 22 33 5c 22 2c 5c 22 37 5c 22 3a 5c 22 32 2e 34 30 2e 31 2e 38 39 31 32 5c 22 2c 5c 22 31 35 5c 22
                                                                                                                                                              Data Ascii: {"table":"zb_analytics","data":"{\"0\":\"\",\"1\":\"9e146be9-c76a-4720-bcdb-53011b87bd06\",\"2\":\"20240718153806\",\"3\":\"BitComet\",\"4\":\"BitComet_Pub_B\",\"5\":\"BitComet\",\"18\":\"\",\"19\":\"\",\"21\":\"\",\"6\":\"3\",\"7\":\"2.40.1.8912\",\"15\"
                                                                                                                                                              2024-07-18 19:38:57 UTC427INHTTP/1.1 200 OK
                                                                                                                                                              Content-Type: application/json; charset=utf-8
                                                                                                                                                              Content-Length: 15
                                                                                                                                                              Connection: close
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:38:57 GMT
                                                                                                                                                              Access-Control-Allow-Origin: *
                                                                                                                                                              Access-Control-Allow-Methods: GET,HEAD,PUT,POST,DELETE
                                                                                                                                                              X-Cache: Miss from cloudfront
                                                                                                                                                              Via: 1.1 3a7672912a556fc61dac56701b81d9e2.cloudfront.net (CloudFront)
                                                                                                                                                              X-Amz-Cf-Pop: CDG53-C1
                                                                                                                                                              X-Amz-Cf-Id: V27sJObpUYDlsNL7ipTNHxygcx8XD_7SMWAs4hQSpqf6bcwZ0_kQ2A==
                                                                                                                                                              2024-07-18 19:38:57 UTC15INData Raw: 7b 22 53 74 61 74 75 73 22 3a 22 4f 4b 22 7d
                                                                                                                                                              Data Ascii: {"Status":"OK"}


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              7192.168.2.449750143.204.205.884436740C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:39:06 UTC326OUTPOST /zbd HTTP/1.1
                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                              Content-Type: application/json; Charset=UTF-8
                                                                                                                                                              Accept: */*
                                                                                                                                                              Authorization: Signature=c0ca984d9cd1b9e9ffdf6097b502a49003af5070b14ac3fa1760d15f36f3f81f
                                                                                                                                                              User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                              Content-Length: 346
                                                                                                                                                              Host: d11iilsblp9z11.cloudfront.net
                                                                                                                                                              2024-07-18 19:39:06 UTC346OUTData Raw: 7b 22 74 61 62 6c 65 22 3a 22 7a 62 5f 61 6e 61 6c 79 74 69 63 73 22 2c 22 64 61 74 61 22 3a 22 7b 5c 22 30 5c 22 3a 5c 22 5c 22 2c 5c 22 31 5c 22 3a 5c 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 5c 22 2c 5c 22 32 5c 22 3a 5c 22 32 30 32 34 30 37 31 38 31 35 33 38 30 36 5c 22 2c 5c 22 33 5c 22 3a 5c 22 42 69 74 43 6f 6d 65 74 5c 22 2c 5c 22 34 5c 22 3a 5c 22 42 69 74 43 6f 6d 65 74 5f 50 75 62 5f 42 5c 22 2c 5c 22 35 5c 22 3a 5c 22 57 65 62 41 64 76 69 73 6f 72 5c 22 2c 5c 22 31 38 5c 22 3a 5c 22 5a 42 5f 57 65 62 41 64 76 69 73 6f 72 5c 22 2c 5c 22 31 39 5c 22 3a 5c 22 5c 22 2c 5c 22 32 31 5c 22 3a 5c 22 5c 22 2c 5c 22 36 5c 22 3a 5c 22 33 5c 22 2c 5c 22 37 5c 22 3a 5c 22 32 2e 34 30 2e
                                                                                                                                                              Data Ascii: {"table":"zb_analytics","data":"{\"0\":\"\",\"1\":\"9e146be9-c76a-4720-bcdb-53011b87bd06\",\"2\":\"20240718153806\",\"3\":\"BitComet\",\"4\":\"BitComet_Pub_B\",\"5\":\"WebAdvisor\",\"18\":\"ZB_WebAdvisor\",\"19\":\"\",\"21\":\"\",\"6\":\"3\",\"7\":\"2.40.
                                                                                                                                                              2024-07-18 19:39:07 UTC427INHTTP/1.1 200 OK
                                                                                                                                                              Content-Type: application/json; charset=utf-8
                                                                                                                                                              Content-Length: 15
                                                                                                                                                              Connection: close
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:07 GMT
                                                                                                                                                              Access-Control-Allow-Origin: *
                                                                                                                                                              Access-Control-Allow-Methods: GET,HEAD,PUT,POST,DELETE
                                                                                                                                                              X-Cache: Miss from cloudfront
                                                                                                                                                              Via: 1.1 4809763494a078a525dc1a2dff5ddf6c.cloudfront.net (CloudFront)
                                                                                                                                                              X-Amz-Cf-Pop: FRA53-C1
                                                                                                                                                              X-Amz-Cf-Id: 40h9FYiPnvRz6LrB2RlBY3PbzMF473Tl9g0wcgoqtGuJpb-C_UANYQ==
                                                                                                                                                              2024-07-18 19:39:07 UTC15INData Raw: 7b 22 53 74 61 74 75 73 22 3a 22 4f 4b 22 7d
                                                                                                                                                              Data Ascii: {"Status":"OK"}


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              8192.168.2.44975152.25.171.1874436316C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:39:07 UTC232OUTPUT /mosaic/2.0/product-web/am/v1/record HTTP/1.1
                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                              Content-Type: application/json
                                                                                                                                                              User-Agent: SA
                                                                                                                                                              X-Api-Key: wtuQtD4DdA8poRbq0pzMh1iysE9YiVlC14kJF9ZI
                                                                                                                                                              Content-Length: 311
                                                                                                                                                              Host: analytics.apis.mcafee.com
                                                                                                                                                              2024-07-18 19:39:07 UTC311OUTData Raw: 7b 22 44 61 74 61 22 3a 7b 22 4d 61 63 68 69 6e 65 5f 49 44 22 3a 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 22 2c 22 4f 53 22 3a 22 57 49 4e 22 2c 22 4f 53 5f 50 6c 61 74 66 6f 72 6d 22 3a 22 36 34 22 2c 22 4f 53 5f 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 31 2e 31 38 38 39 22 2c 22 50 72 6f 64 75 63 74 5f 56 65 72 73 69 6f 6e 22 3a 22 34 2e 31 2e 31 2e 38 36 35 22 2c 22 55 55 49 44 22 3a 22 7b 35 32 36 34 31 37 38 43 2d 43 35 31 36 2d 34 34 39 37 2d 39 43 34 42 2d 43 38 45 30 42 44 39 34 39 45 30 35 7d 22 2c 22 65 61 22 3a 22 50 72 6f 63 65 73 73 22 2c 22 65 63 22 3a 22 42 6f 6f 74 53 74 72 61 70 49 6e 73 74 61 6c 6c 65 72 22 2c 22 65 6c 22 3a 22 53 74 61 72 74 65 64 22
                                                                                                                                                              Data Ascii: {"Data":{"Machine_ID":"9e146be9-c76a-4720-bcdb-53011b87bd06","OS":"WIN","OS_Platform":"64","OS_Version":"10.0.19041.1889","Product_Version":"4.1.1.865","UUID":"{5264178C-C516-4497-9C4B-C8E0BD949E05}","ea":"Process","ec":"BootStrapInstaller","el":"Started"
                                                                                                                                                              2024-07-18 19:39:07 UTC303INHTTP/1.1 200 OK
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:07 GMT
                                                                                                                                                              Content-Type: application/x-amz-json-1.1
                                                                                                                                                              Content-Length: 16
                                                                                                                                                              Connection: close
                                                                                                                                                              x-amzn-RequestId: e979f743-de51-89e5-b66a-86d8c1cdccb8
                                                                                                                                                              x-amz-id-2: +RFLrbyw7O0nOIMO1oprHhRJFmRfIghaHAu5Um2ciqkLPekL+U1R4gR+qBY1KzIt5rmUV+l9uUf/Bqjik8SZeCjkW87zpqoR
                                                                                                                                                              2024-07-18 19:39:07 UTC16INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 22 6f 6b 22 7d
                                                                                                                                                              Data Ascii: {"message":"ok"}


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              9192.168.2.44975252.25.171.1874436316C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:39:08 UTC232OUTPUT /mosaic/2.0/product-web/am/v1/record HTTP/1.1
                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                              Content-Type: application/json
                                                                                                                                                              User-Agent: SA
                                                                                                                                                              X-Api-Key: wtuQtD4DdA8poRbq0pzMh1iysE9YiVlC14kJF9ZI
                                                                                                                                                              Content-Length: 311
                                                                                                                                                              Host: analytics.apis.mcafee.com
                                                                                                                                                              2024-07-18 19:39:08 UTC311OUTData Raw: 7b 22 44 61 74 61 22 3a 7b 22 4d 61 63 68 69 6e 65 5f 49 44 22 3a 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 22 2c 22 4f 53 22 3a 22 57 49 4e 22 2c 22 4f 53 5f 50 6c 61 74 66 6f 72 6d 22 3a 22 36 34 22 2c 22 4f 53 5f 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 31 2e 31 38 38 39 22 2c 22 50 72 6f 64 75 63 74 5f 56 65 72 73 69 6f 6e 22 3a 22 34 2e 31 2e 31 2e 38 36 35 22 2c 22 55 55 49 44 22 3a 22 7b 35 32 36 34 31 37 38 43 2d 43 35 31 36 2d 34 34 39 37 2d 39 43 34 42 2d 43 38 45 30 42 44 39 34 39 45 30 35 7d 22 2c 22 65 61 22 3a 22 49 6e 73 74 61 6c 6c 22 2c 22 65 63 22 3a 22 42 6f 6f 74 53 74 72 61 70 49 6e 73 74 61 6c 6c 65 72 22 2c 22 65 6c 22 3a 22 53 74 61 72 74 65 64 22
                                                                                                                                                              Data Ascii: {"Data":{"Machine_ID":"9e146be9-c76a-4720-bcdb-53011b87bd06","OS":"WIN","OS_Platform":"64","OS_Version":"10.0.19041.1889","Product_Version":"4.1.1.865","UUID":"{5264178C-C516-4497-9C4B-C8E0BD949E05}","ea":"Install","ec":"BootStrapInstaller","el":"Started"
                                                                                                                                                              2024-07-18 19:39:08 UTC303INHTTP/1.1 200 OK
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:08 GMT
                                                                                                                                                              Content-Type: application/x-amz-json-1.1
                                                                                                                                                              Content-Length: 16
                                                                                                                                                              Connection: close
                                                                                                                                                              x-amz-id-2: TFPgsHB9tNVqf/imYahVDumMRKL8ezLA1J3xCTzJuLMCwUITNnDkJMDFCfOmL+jQvxVFKMbFfuplyQSAE2WfAmxDVKYWr9qO
                                                                                                                                                              x-amzn-RequestId: d1b742f3-15ab-0920-8ea4-336f8a4ff4a3
                                                                                                                                                              2024-07-18 19:39:08 UTC16INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 22 6f 6b 22 7d
                                                                                                                                                              Data Ascii: {"message":"ok"}


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              10192.168.2.449753143.204.205.884436740C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:39:08 UTC326OUTPOST /zbd HTTP/1.1
                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                              Content-Type: application/json; Charset=UTF-8
                                                                                                                                                              Accept: */*
                                                                                                                                                              Authorization: Signature=c0ca984d9cd1b9e9ffdf6097b502a49003af5070b14ac3fa1760d15f36f3f81f
                                                                                                                                                              User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                              Content-Length: 354
                                                                                                                                                              Host: d11iilsblp9z11.cloudfront.net
                                                                                                                                                              2024-07-18 19:39:08 UTC354OUTData Raw: 7b 22 74 61 62 6c 65 22 3a 22 7a 62 5f 61 6e 61 6c 79 74 69 63 73 22 2c 22 64 61 74 61 22 3a 22 7b 5c 22 30 5c 22 3a 5c 22 5c 22 2c 5c 22 31 5c 22 3a 5c 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 5c 22 2c 5c 22 32 5c 22 3a 5c 22 32 30 32 34 30 37 31 38 31 35 33 38 30 36 5c 22 2c 5c 22 33 5c 22 3a 5c 22 42 69 74 43 6f 6d 65 74 5c 22 2c 5c 22 34 5c 22 3a 5c 22 42 69 74 43 6f 6d 65 74 5f 50 75 62 5f 42 5c 22 2c 5c 22 35 5c 22 3a 5c 22 41 56 47 5f 41 56 5c 22 2c 5c 22 31 38 5c 22 3a 5c 22 5a 42 5f 41 56 47 5f 41 56 5f 54 72 75 73 74 50 69 6c 6f 74 5c 22 2c 5c 22 31 39 5c 22 3a 5c 22 5c 22 2c 5c 22 32 31 5c 22 3a 5c 22 5c 22 2c 5c 22 36 5c 22 3a 5c 22 33 5c 22 2c 5c 22 37 5c 22 3a 5c 22 32 2e
                                                                                                                                                              Data Ascii: {"table":"zb_analytics","data":"{\"0\":\"\",\"1\":\"9e146be9-c76a-4720-bcdb-53011b87bd06\",\"2\":\"20240718153806\",\"3\":\"BitComet\",\"4\":\"BitComet_Pub_B\",\"5\":\"AVG_AV\",\"18\":\"ZB_AVG_AV_TrustPilot\",\"19\":\"\",\"21\":\"\",\"6\":\"3\",\"7\":\"2.
                                                                                                                                                              2024-07-18 19:39:09 UTC427INHTTP/1.1 200 OK
                                                                                                                                                              Content-Type: application/json; charset=utf-8
                                                                                                                                                              Content-Length: 15
                                                                                                                                                              Connection: close
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:09 GMT
                                                                                                                                                              Access-Control-Allow-Origin: *
                                                                                                                                                              Access-Control-Allow-Methods: GET,HEAD,PUT,POST,DELETE
                                                                                                                                                              X-Cache: Miss from cloudfront
                                                                                                                                                              Via: 1.1 12c16baed6578bf50fb0eaa233f2bc84.cloudfront.net (CloudFront)
                                                                                                                                                              X-Amz-Cf-Pop: FRA53-C1
                                                                                                                                                              X-Amz-Cf-Id: BVRhjQXCHZCAiDOvieD4GPOafTyG2dNOVbLscgWiQibSwh1agN3TcQ==
                                                                                                                                                              2024-07-18 19:39:09 UTC15INData Raw: 7b 22 53 74 61 74 75 73 22 3a 22 4f 4b 22 7d
                                                                                                                                                              Data Ascii: {"Status":"OK"}


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              11192.168.2.44976034.117.223.223443824C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:39:11 UTC139OUTPOST /v4/receive/json/25 HTTP/1.1
                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                              User-Agent: Icarus Http/1.0
                                                                                                                                                              Content-Length: 1281
                                                                                                                                                              Host: analytics.avcdn.net
                                                                                                                                                              2024-07-18 19:39:11 UTC1281OUTData Raw: 7b 22 72 65 63 6f 72 64 22 3a 5b 7b 22 65 76 65 6e 74 22 3a 7b 22 74 79 70 65 22 3a 32 35 2c 22 73 75 62 74 79 70 65 22 3a 31 2c 22 72 65 71 75 65 73 74 5f 69 64 22 3a 22 30 30 62 31 32 65 65 33 2d 36 31 39 33 2d 34 32 33 64 2d 62 35 36 38 2d 34 66 34 34 38 35 33 63 36 63 66 32 22 2c 22 74 69 6d 65 22 3a 31 37 32 31 33 33 37 39 39 35 36 33 39 7d 2c 22 73 65 74 75 70 22 3a 7b 22 63 6f 6d 6d 6f 6e 22 3a 7b 22 6f 70 65 72 61 74 69 6f 6e 22 3a 22 69 6e 73 74 61 6c 6c 22 2c 22 73 65 73 73 69 6f 6e 5f 69 64 22 3a 22 31 38 34 30 63 36 37 38 2d 64 36 32 61 2d 34 39 34 35 2d 38 65 34 66 2d 33 36 65 61 66 33 66 30 63 34 61 35 22 2c 22 73 74 61 67 65 22 3a 22 73 66 78 2d 73 74 61 72 74 22 2c 22 74 69 74 6c 65 22 3a 22 22 7d 2c 22 70 72 6f 64 75 63 74 22 3a 7b 22 6e
                                                                                                                                                              Data Ascii: {"record":[{"event":{"type":25,"subtype":1,"request_id":"00b12ee3-6193-423d-b568-4f44853c6cf2","time":1721337995639},"setup":{"common":{"operation":"install","session_id":"1840c678-d62a-4945-8e4f-36eaf3f0c4a5","stage":"sfx-start","title":""},"product":{"n
                                                                                                                                                              2024-07-18 19:39:11 UTC216INHTTP/1.1 200 OK
                                                                                                                                                              Server: nginx
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:11 GMT
                                                                                                                                                              Content-Type: application/json
                                                                                                                                                              Content-Length: 19
                                                                                                                                                              Via: 1.1 google
                                                                                                                                                              Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                                                                                              Connection: close
                                                                                                                                                              2024-07-18 19:39:11 UTC19INData Raw: 7b 22 70 72 6f 63 65 73 73 65 64 22 3a 20 74 72 75 65 7d
                                                                                                                                                              Data Ascii: {"processed": true}


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              12192.168.2.44976152.25.171.1874436316C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:39:12 UTC232OUTPUT /mosaic/2.0/product-web/am/v1/record HTTP/1.1
                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                              Content-Type: application/json
                                                                                                                                                              User-Agent: SA
                                                                                                                                                              X-Api-Key: wtuQtD4DdA8poRbq0pzMh1iysE9YiVlC14kJF9ZI
                                                                                                                                                              Content-Length: 336
                                                                                                                                                              Host: analytics.apis.mcafee.com
                                                                                                                                                              2024-07-18 19:39:12 UTC336OUTData Raw: 7b 22 44 61 74 61 22 3a 7b 22 4d 61 63 68 69 6e 65 5f 49 44 22 3a 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 22 2c 22 4f 53 22 3a 22 57 49 4e 22 2c 22 4f 53 5f 50 6c 61 74 66 6f 72 6d 22 3a 22 36 34 22 2c 22 4f 53 5f 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 31 2e 31 38 38 39 22 2c 22 50 72 6f 64 75 63 74 5f 56 65 72 73 69 6f 6e 22 3a 22 34 2e 31 2e 31 2e 38 36 35 22 2c 22 55 55 49 44 22 3a 22 7b 35 32 36 34 31 37 38 43 2d 43 35 31 36 2d 34 34 39 37 2d 39 43 34 42 2d 43 38 45 30 42 44 39 34 39 45 30 35 7d 22 2c 22 65 61 22 3a 22 50 61 69 64 44 69 73 74 72 69 62 75 74 69 6f 6e 3d 74 72 75 65 22 2c 22 65 63 22 3a 22 49 6e 70 75 74 50 61 72 61 6d 65 74 65 72 73 22 2c 22 65 6c
                                                                                                                                                              Data Ascii: {"Data":{"Machine_ID":"9e146be9-c76a-4720-bcdb-53011b87bd06","OS":"WIN","OS_Platform":"64","OS_Version":"10.0.19041.1889","Product_Version":"4.1.1.865","UUID":"{5264178C-C516-4497-9C4B-C8E0BD949E05}","ea":"PaidDistribution=true","ec":"InputParameters","el
                                                                                                                                                              2024-07-18 19:39:12 UTC303INHTTP/1.1 200 OK
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:12 GMT
                                                                                                                                                              Content-Type: application/x-amz-json-1.1
                                                                                                                                                              Content-Length: 16
                                                                                                                                                              Connection: close
                                                                                                                                                              x-amzn-RequestId: dcfdbb00-51d9-b901-83ee-caa0cf1be520
                                                                                                                                                              x-amz-id-2: Cu5HgkABJsBTpbA7kid2iq203KPUFFE5xIdzUSambz/jnozLnwmFpYKX8HMKV3SworEZOrBFg4bF2KV2IusV9Zeu4lXbZ7NL
                                                                                                                                                              2024-07-18 19:39:12 UTC16INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 22 6f 6b 22 7d
                                                                                                                                                              Data Ascii: {"message":"ok"}


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              13192.168.2.44976234.117.223.223443824C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:39:12 UTC139OUTPOST /v4/receive/json/25 HTTP/1.1
                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                              User-Agent: Icarus Http/1.0
                                                                                                                                                              Content-Length: 1312
                                                                                                                                                              Host: analytics.avcdn.net
                                                                                                                                                              2024-07-18 19:39:12 UTC1312OUTData Raw: 7b 22 72 65 63 6f 72 64 22 3a 5b 7b 22 65 76 65 6e 74 22 3a 7b 22 74 79 70 65 22 3a 32 35 2c 22 73 75 62 74 79 70 65 22 3a 31 2c 22 72 65 71 75 65 73 74 5f 69 64 22 3a 22 63 61 64 32 65 38 32 38 2d 30 33 33 39 2d 34 64 64 66 2d 39 63 62 65 2d 34 33 35 37 36 34 30 65 64 35 37 33 22 2c 22 74 69 6d 65 22 3a 31 37 32 31 33 33 37 39 39 35 39 31 34 7d 2c 22 73 65 74 75 70 22 3a 7b 22 63 6f 6d 6d 6f 6e 22 3a 7b 22 6f 70 65 72 61 74 69 6f 6e 22 3a 22 69 6e 73 74 61 6c 6c 22 2c 22 73 65 73 73 69 6f 6e 5f 69 64 22 3a 22 31 38 34 30 63 36 37 38 2d 64 36 32 61 2d 34 39 34 35 2d 38 65 34 66 2d 33 36 65 61 66 33 66 30 63 34 61 35 22 2c 22 73 74 61 67 65 22 3a 22 73 66 78 2d 70 72 65 70 61 72 69 6e 67 22 2c 22 74 69 74 6c 65 22 3a 22 22 7d 2c 22 70 72 6f 64 75 63 74 22
                                                                                                                                                              Data Ascii: {"record":[{"event":{"type":25,"subtype":1,"request_id":"cad2e828-0339-4ddf-9cbe-4357640ed573","time":1721337995914},"setup":{"common":{"operation":"install","session_id":"1840c678-d62a-4945-8e4f-36eaf3f0c4a5","stage":"sfx-preparing","title":""},"product"
                                                                                                                                                              2024-07-18 19:39:12 UTC216INHTTP/1.1 200 OK
                                                                                                                                                              Server: nginx
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:12 GMT
                                                                                                                                                              Content-Type: application/json
                                                                                                                                                              Content-Length: 19
                                                                                                                                                              Via: 1.1 google
                                                                                                                                                              Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                                                                                              Connection: close
                                                                                                                                                              2024-07-18 19:39:12 UTC19INData Raw: 7b 22 70 72 6f 63 65 73 73 65 64 22 3a 20 74 72 75 65 7d
                                                                                                                                                              Data Ascii: {"processed": true}


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              14192.168.2.44977752.25.171.1874436316C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:39:19 UTC232OUTPUT /mosaic/2.0/product-web/am/v1/record HTTP/1.1
                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                              Content-Type: application/json
                                                                                                                                                              User-Agent: SA
                                                                                                                                                              X-Api-Key: wtuQtD4DdA8poRbq0pzMh1iysE9YiVlC14kJF9ZI
                                                                                                                                                              Content-Length: 507
                                                                                                                                                              Host: analytics.apis.mcafee.com
                                                                                                                                                              2024-07-18 19:39:19 UTC507OUTData Raw: 7b 22 44 61 74 61 22 3a 7b 22 41 66 66 69 64 22 3a 22 39 31 30 38 38 22 2c 22 43 6f 75 6e 74 72 79 5f 43 6f 64 65 22 3a 22 55 53 22 2c 22 44 69 73 74 72 69 62 75 74 69 6f 6e 5f 53 75 62 49 44 22 3a 22 55 4e 44 45 46 49 4e 45 44 22 2c 22 49 6e 73 74 61 6c 6c 5f 49 44 22 3a 22 55 4e 44 45 46 49 4e 45 44 22 2c 22 49 6e 73 74 61 6c 6c 5f 4c 6f 75 64 6e 65 73 73 22 3a 22 53 69 6c 65 6e 74 22 2c 22 49 6e 73 74 61 6c 6c 5f 53 6f 75 72 63 65 22 3a 22 50 61 69 64 44 69 73 74 72 69 62 75 74 69 6f 6e 22 2c 22 49 72 6f 6e 73 6f 75 72 63 65 5f 50 69 78 65 6c 22 3a 22 55 4e 44 45 46 49 4e 45 44 22 2c 22 4d 61 63 68 69 6e 65 5f 49 44 22 3a 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 22 2c 22 4f 53 22 3a
                                                                                                                                                              Data Ascii: {"Data":{"Affid":"91088","Country_Code":"US","Distribution_SubID":"UNDEFINED","Install_ID":"UNDEFINED","Install_Loudness":"Silent","Install_Source":"PaidDistribution","Ironsource_Pixel":"UNDEFINED","Machine_ID":"9e146be9-c76a-4720-bcdb-53011b87bd06","OS":
                                                                                                                                                              2024-07-18 19:39:19 UTC303INHTTP/1.1 200 OK
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:19 GMT
                                                                                                                                                              Content-Type: application/x-amz-json-1.1
                                                                                                                                                              Content-Length: 16
                                                                                                                                                              Connection: close
                                                                                                                                                              x-amzn-RequestId: c8552d14-3eea-dc30-9746-5cb36571f0bd
                                                                                                                                                              x-amz-id-2: OKGKND/ld/vcEeRUPVFfy6rAjsum/VNFl/0lY2CGlrEqhXLHJaWHKS7wwiUrdK7A8jVprcfJn4qrKnesUx+4jCBUnGRhT3ay
                                                                                                                                                              2024-07-18 19:39:19 UTC16INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 22 6f 6b 22 7d
                                                                                                                                                              Data Ascii: {"message":"ok"}


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              15192.168.2.449776161.97.135.854436032C:\Program Files\BitComet\BitComet.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:39:20 UTC326OUTGET /client/bitcomet/?ver=2.08&intl=en_us&osintl=jv&cid=ae7b79c1d0de3420440a531a8fc59151&btcnt=0&httpcnt=0&p=x64&idt=20240718 HTTP/1.1
                                                                                                                                                              Host: update.bitcomet.com
                                                                                                                                                              Connection: close
                                                                                                                                                              Accept: */*
                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
                                                                                                                                                              2024-07-18 19:39:20 UTC283INHTTP/1.1 200 OK
                                                                                                                                                              Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:20 GMT
                                                                                                                                                              Content-Type: text/xml; charset=utf-8
                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                              Connection: close
                                                                                                                                                              Vary: Accept-Encoding
                                                                                                                                                              Strict-Transport-Security: max-age=15768000; preload
                                                                                                                                                              X-Content-Type-Options: nosniff
                                                                                                                                                              2024-07-18 19:39:20 UTC5589INData Raw: 31 35 63 38 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 42 69 74 43 6f 6d 65 74 20 76 65 72 73 69 6f 6e 3d 22 30 2e 31 22 3e 0a 20 20 3c 41 75 74 6f 55 70 64 61 74 65 3e 0a 20 20 20 20 3c 55 70 64 61 74 65 47 72 6f 75 70 4c 69 73 74 3e 0a 20 20 20 20 20 20 3c 46 61 76 6f 75 72 69 74 65 73 3e 0a 20 20 20 20 20 20 20 20 3c 66 69 6c 65 31 20 76 65 72 5f 6d 69 6e 3d 22 31 2e 30 35 22 20 76 65 72 5f 6d 61 78 3d 22 32 2e 39 39 22 20 6c 61 6e 67 75 61 67 65 3d 22 65 6e 5f 75 73 22 20 6e 61 6d 65 3d 22 66 61 76 5f 65 6e 5f 75 73 2e 78 6d 6c 22 20 6d 64 35 3d 22 64 35 32 36 31 65 65 64 32 61 64 36 61 33 64 35 37 35 61 34 31 61 64 30 34 64 32 61 36 34 32 65 22 3e 68 74 74 70 3a 2f 2f
                                                                                                                                                              Data Ascii: 15c8<?xml version="1.0" encoding="UTF-8"?><BitComet version="0.1"> <AutoUpdate> <UpdateGroupList> <Favourites> <file1 ver_min="1.05" ver_max="2.99" language="en_us" name="fav_en_us.xml" md5="d5261eed2ad6a3d575a41ad04d2a642e">http://


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              16192.168.2.449784161.97.135.854433608C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:39:21 UTC734OUTGET /start/en_us/2.08/ HTTP/1.1
                                                                                                                                                              Host: inside.bitcomet.com
                                                                                                                                                              Connection: keep-alive
                                                                                                                                                              sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"
                                                                                                                                                              sec-ch-ua-mobile: ?0
                                                                                                                                                              sec-ch-ua-platform: "Windows"
                                                                                                                                                              Upgrade-Insecure-Requests: 1
                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                                                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                                                                                                                              Sec-Fetch-Site: none
                                                                                                                                                              Sec-Fetch-Mode: navigate
                                                                                                                                                              Sec-Fetch-User: ?1
                                                                                                                                                              Sec-Fetch-Dest: document
                                                                                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                                                                                              Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                                                                                                                              2024-07-18 19:39:21 UTC424INHTTP/1.1 200 OK
                                                                                                                                                              Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:21 GMT
                                                                                                                                                              Content-Type: text/html
                                                                                                                                                              Content-Length: 1805
                                                                                                                                                              Last-Modified: Mon, 17 Jun 2024 02:19:32 GMT
                                                                                                                                                              Connection: close
                                                                                                                                                              Vary: Accept-Encoding
                                                                                                                                                              ETag: "666f9d34-70d"
                                                                                                                                                              Expires: Sun, 21 Jul 2024 19:39:21 GMT
                                                                                                                                                              Cache-Control: max-age=259200
                                                                                                                                                              Strict-Transport-Security: max-age=15768000; preload
                                                                                                                                                              X-Content-Type-Options: nosniff
                                                                                                                                                              Accept-Ranges: bytes
                                                                                                                                                              2024-07-18 19:39:21 UTC1805INData Raw: ef bb bf 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0d 0a 3c 74 69 74 6c
                                                                                                                                                              Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><titl


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              17192.168.2.449779161.97.135.854436032C:\Program Files\BitComet\BitComet.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:39:21 UTC326OUTGET /client/bitcomet/?ver=2.08&intl=en_us&osintl=jv&cid=ae7b79c1d0de3420440a531a8fc59151&btcnt=0&httpcnt=0&p=x64&idt=20240718 HTTP/1.1
                                                                                                                                                              Host: update.bitcomet.com
                                                                                                                                                              Connection: close
                                                                                                                                                              Accept: */*
                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
                                                                                                                                                              2024-07-18 19:39:21 UTC283INHTTP/1.1 200 OK
                                                                                                                                                              Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:21 GMT
                                                                                                                                                              Content-Type: text/xml; charset=utf-8
                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                              Connection: close
                                                                                                                                                              Vary: Accept-Encoding
                                                                                                                                                              Strict-Transport-Security: max-age=15768000; preload
                                                                                                                                                              X-Content-Type-Options: nosniff
                                                                                                                                                              2024-07-18 19:39:21 UTC5589INData Raw: 31 35 63 38 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 42 69 74 43 6f 6d 65 74 20 76 65 72 73 69 6f 6e 3d 22 30 2e 31 22 3e 0a 20 20 3c 41 75 74 6f 55 70 64 61 74 65 3e 0a 20 20 20 20 3c 55 70 64 61 74 65 47 72 6f 75 70 4c 69 73 74 3e 0a 20 20 20 20 20 20 3c 46 61 76 6f 75 72 69 74 65 73 3e 0a 20 20 20 20 20 20 20 20 3c 66 69 6c 65 31 20 76 65 72 5f 6d 69 6e 3d 22 31 2e 30 35 22 20 76 65 72 5f 6d 61 78 3d 22 32 2e 39 39 22 20 6c 61 6e 67 75 61 67 65 3d 22 65 6e 5f 75 73 22 20 6e 61 6d 65 3d 22 66 61 76 5f 65 6e 5f 75 73 2e 78 6d 6c 22 20 6d 64 35 3d 22 64 35 32 36 31 65 65 64 32 61 64 36 61 33 64 35 37 35 61 34 31 61 64 30 34 64 32 61 36 34 32 65 22 3e 68 74 74 70 3a 2f 2f
                                                                                                                                                              Data Ascii: 15c8<?xml version="1.0" encoding="UTF-8"?><BitComet version="0.1"> <AutoUpdate> <UpdateGroupList> <Favourites> <file1 ver_min="1.05" ver_max="2.99" language="en_us" name="fav_en_us.xml" md5="d5261eed2ad6a3d575a41ad04d2a642e">http://


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              18192.168.2.449778161.97.135.854436032C:\Program Files\BitComet\BitComet.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:39:21 UTC326OUTGET /client/bitcomet/?ver=2.08&intl=en_us&osintl=jv&cid=ae7b79c1d0de3420440a531a8fc59151&btcnt=0&httpcnt=0&p=x64&idt=20240718 HTTP/1.1
                                                                                                                                                              Host: update.bitcomet.com
                                                                                                                                                              Connection: close
                                                                                                                                                              Accept: */*
                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
                                                                                                                                                              2024-07-18 19:39:21 UTC283INHTTP/1.1 200 OK
                                                                                                                                                              Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:21 GMT
                                                                                                                                                              Content-Type: text/xml; charset=utf-8
                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                              Connection: close
                                                                                                                                                              Vary: Accept-Encoding
                                                                                                                                                              Strict-Transport-Security: max-age=15768000; preload
                                                                                                                                                              X-Content-Type-Options: nosniff
                                                                                                                                                              2024-07-18 19:39:21 UTC5589INData Raw: 31 35 63 38 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 42 69 74 43 6f 6d 65 74 20 76 65 72 73 69 6f 6e 3d 22 30 2e 31 22 3e 0a 20 20 3c 41 75 74 6f 55 70 64 61 74 65 3e 0a 20 20 20 20 3c 55 70 64 61 74 65 47 72 6f 75 70 4c 69 73 74 3e 0a 20 20 20 20 20 20 3c 46 61 76 6f 75 72 69 74 65 73 3e 0a 20 20 20 20 20 20 20 20 3c 66 69 6c 65 31 20 76 65 72 5f 6d 69 6e 3d 22 31 2e 30 35 22 20 76 65 72 5f 6d 61 78 3d 22 32 2e 39 39 22 20 6c 61 6e 67 75 61 67 65 3d 22 65 6e 5f 75 73 22 20 6e 61 6d 65 3d 22 66 61 76 5f 65 6e 5f 75 73 2e 78 6d 6c 22 20 6d 64 35 3d 22 64 35 32 36 31 65 65 64 32 61 64 36 61 33 64 35 37 35 61 34 31 61 64 30 34 64 32 61 36 34 32 65 22 3e 68 74 74 70 3a 2f 2f
                                                                                                                                                              Data Ascii: 15c8<?xml version="1.0" encoding="UTF-8"?><BitComet version="0.1"> <AutoUpdate> <UpdateGroupList> <Favourites> <file1 ver_min="1.05" ver_max="2.99" language="en_us" name="fav_en_us.xml" md5="d5261eed2ad6a3d575a41ad04d2a642e">http://


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              19192.168.2.449780161.97.135.854436032C:\Program Files\BitComet\BitComet.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:39:21 UTC326OUTGET /client/bitcomet/?ver=2.08&intl=en_us&osintl=jv&cid=ae7b79c1d0de3420440a531a8fc59151&btcnt=0&httpcnt=0&p=x64&idt=20240718 HTTP/1.1
                                                                                                                                                              Host: update.bitcomet.com
                                                                                                                                                              Connection: close
                                                                                                                                                              Accept: */*
                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
                                                                                                                                                              2024-07-18 19:39:21 UTC283INHTTP/1.1 200 OK
                                                                                                                                                              Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:21 GMT
                                                                                                                                                              Content-Type: text/xml; charset=utf-8
                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                              Connection: close
                                                                                                                                                              Vary: Accept-Encoding
                                                                                                                                                              Strict-Transport-Security: max-age=15768000; preload
                                                                                                                                                              X-Content-Type-Options: nosniff
                                                                                                                                                              2024-07-18 19:39:21 UTC5589INData Raw: 31 35 63 38 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 42 69 74 43 6f 6d 65 74 20 76 65 72 73 69 6f 6e 3d 22 30 2e 31 22 3e 0a 20 20 3c 41 75 74 6f 55 70 64 61 74 65 3e 0a 20 20 20 20 3c 55 70 64 61 74 65 47 72 6f 75 70 4c 69 73 74 3e 0a 20 20 20 20 20 20 3c 46 61 76 6f 75 72 69 74 65 73 3e 0a 20 20 20 20 20 20 20 20 3c 66 69 6c 65 31 20 76 65 72 5f 6d 69 6e 3d 22 31 2e 30 35 22 20 76 65 72 5f 6d 61 78 3d 22 32 2e 39 39 22 20 6c 61 6e 67 75 61 67 65 3d 22 65 6e 5f 75 73 22 20 6e 61 6d 65 3d 22 66 61 76 5f 65 6e 5f 75 73 2e 78 6d 6c 22 20 6d 64 35 3d 22 64 35 32 36 31 65 65 64 32 61 64 36 61 33 64 35 37 35 61 34 31 61 64 30 34 64 32 61 36 34 32 65 22 3e 68 74 74 70 3a 2f 2f
                                                                                                                                                              Data Ascii: 15c8<?xml version="1.0" encoding="UTF-8"?><BitComet version="0.1"> <AutoUpdate> <UpdateGroupList> <Favourites> <file1 ver_min="1.05" ver_max="2.99" language="en_us" name="fav_en_us.xml" md5="d5261eed2ad6a3d575a41ad04d2a642e">http://


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              20192.168.2.449781161.97.135.854436032C:\Program Files\BitComet\BitComet.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:39:24 UTC326OUTGET /client/bitcomet/?ver=2.08&intl=en_us&osintl=jv&cid=ae7b79c1d0de3420440a531a8fc59151&btcnt=0&httpcnt=0&p=x64&idt=20240718 HTTP/1.1
                                                                                                                                                              Host: update.bitcomet.com
                                                                                                                                                              Connection: close
                                                                                                                                                              Accept: */*
                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
                                                                                                                                                              2024-07-18 19:39:24 UTC283INHTTP/1.1 200 OK
                                                                                                                                                              Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:24 GMT
                                                                                                                                                              Content-Type: text/xml; charset=utf-8
                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                              Connection: close
                                                                                                                                                              Vary: Accept-Encoding
                                                                                                                                                              Strict-Transport-Security: max-age=15768000; preload
                                                                                                                                                              X-Content-Type-Options: nosniff
                                                                                                                                                              2024-07-18 19:39:24 UTC5589INData Raw: 31 35 63 38 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 42 69 74 43 6f 6d 65 74 20 76 65 72 73 69 6f 6e 3d 22 30 2e 31 22 3e 0a 20 20 3c 41 75 74 6f 55 70 64 61 74 65 3e 0a 20 20 20 20 3c 55 70 64 61 74 65 47 72 6f 75 70 4c 69 73 74 3e 0a 20 20 20 20 20 20 3c 46 61 76 6f 75 72 69 74 65 73 3e 0a 20 20 20 20 20 20 20 20 3c 66 69 6c 65 31 20 76 65 72 5f 6d 69 6e 3d 22 31 2e 30 35 22 20 76 65 72 5f 6d 61 78 3d 22 32 2e 39 39 22 20 6c 61 6e 67 75 61 67 65 3d 22 65 6e 5f 75 73 22 20 6e 61 6d 65 3d 22 66 61 76 5f 65 6e 5f 75 73 2e 78 6d 6c 22 20 6d 64 35 3d 22 64 35 32 36 31 65 65 64 32 61 64 36 61 33 64 35 37 35 61 34 31 61 64 30 34 64 32 61 36 34 32 65 22 3e 68 74 74 70 3a 2f 2f
                                                                                                                                                              Data Ascii: 15c8<?xml version="1.0" encoding="UTF-8"?><BitComet version="0.1"> <AutoUpdate> <UpdateGroupList> <Favourites> <file1 ver_min="1.05" ver_max="2.99" language="en_us" name="fav_en_us.xml" md5="d5261eed2ad6a3d575a41ad04d2a642e">http://


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              21192.168.2.44979695.111.225.2114433608C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:39:24 UTC755OUTGET /?random=1&style=iframe HTTP/1.1
                                                                                                                                                              Host: apphit.com
                                                                                                                                                              Connection: keep-alive
                                                                                                                                                              sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"
                                                                                                                                                              sec-ch-ua-mobile: ?0
                                                                                                                                                              sec-ch-ua-platform: "Windows"
                                                                                                                                                              Upgrade-Insecure-Requests: 1
                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                                                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                                                                                                                              Sec-Fetch-Site: cross-site
                                                                                                                                                              Sec-Fetch-Mode: navigate
                                                                                                                                                              Sec-Fetch-Dest: document
                                                                                                                                                              Referer: https://inside.bitcomet.com/
                                                                                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                                                                                              Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                                                                                                                              2024-07-18 19:39:25 UTC1259INHTTP/1.1 302 Found
                                                                                                                                                              Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                              Content-Type: text/html; charset=UTF-8
                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                              Connection: close
                                                                                                                                                              Cache-Control: no-cache, private
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:25 GMT
                                                                                                                                                              Location: https://apphit.com/app/veracrypt?style=iframe&link=
                                                                                                                                                              Set-Cookie: XSRF-TOKEN=eyJpdiI6IllZdWd4SGgxeCtkeEZoazN3RlFWcVE9PSIsInZhbHVlIjoiUFRaT1VuWXNhNEtXZlluK1ZoR29qMXY5dDFpTTVXUWFkSXA2dGVtZ0llckxNZVNtVS9TcVNhK0ZnZWRFM2U4VnhJdDhBN0I5Y3ZMZTdXU2hTMXpGMzJrTjlsZGllQ1MzNEFWTTZLRUpTTnJTVU1kbmM0dytaT05pTzZITnpqblAiLCJtYWMiOiI1ODNkMmQ0Njk0NjhiMzE0ZWM0OWU5Y2RmOGRmMDI2ZDNkZTg4ZGY4NGMzZTQ1NGU1OTlmY2EwNGY2Yjk4ODZjIiwidGFnIjoiIn0%3D; expires=Thu, 18 Jul 2024 21:39:25 GMT; Max-Age=7200; path=/; samesite=lax
                                                                                                                                                              Set-Cookie: apphit_session=eyJpdiI6IjNsamJxYVYza29BR0JyM2Z2ZzJvWWc9PSIsInZhbHVlIjoiWk9OQlZlditaSWxuVS9NVmVxRWtRQXVIcEtnam55VjZxdzFNMUxuMFVISjVYZEh6ZzRaZFBwK0dNR05hMXd6a0t6eWdiNDJDL2pPenpUTkJJUVgxMlRqN1cwMDVEcUJIYm4vSVNjckplM0w1RVArY3NsQm5NcnZvaDdDZFBBT1AiLCJtYWMiOiIyNjVkY2Y4MDQ2OWFlYjhhN2I3ODMwYTg3NjliM2YwODU0ZTIyN2QzNzM5ZGRlZGE3NmMxOTAxOTllZDY2MDU5IiwidGFnIjoiIn0%3D; expires=Thu, 18 Jul 2024 21:39:25 GMT; Max-Age=7200; path=/; httponly; samesite=lax
                                                                                                                                                              Strict-Transport-Security: max-age=15768000; preload
                                                                                                                                                              X-Content-Type-Options: nosniff
                                                                                                                                                              2024-07-18 19:39:25 UTC478INData Raw: 31 64 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 27 68 74 74 70 73 3a 2f 2f 61 70 70 68 69 74 2e 63 6f 6d 2f 61 70 70 2f 76 65 72 61 63 72 79 70 74 3f 73 74 79 6c 65 3d 69 66 72 61 6d 65 26 61 6d 70 3b 6c 69 6e 6b 3d 27 22 20 2f 3e 0a 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 73 3a 2f 2f 61 70 70 68 69 74 2e 63 6f 6d 2f 61 70 70 2f 76 65 72 61 63 72 79 70 74 3f 73 74 79 6c 65 3d 69
                                                                                                                                                              Data Ascii: 1d2<!DOCTYPE html><html> <head> <meta charset="UTF-8" /> <meta http-equiv="refresh" content="0;url='https://apphit.com/app/veracrypt?style=iframe&amp;link='" /> <title>Redirecting to https://apphit.com/app/veracrypt?style=i


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              22192.168.2.44979795.111.225.2114433608C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:39:25 UTC1487OUTGET /app/veracrypt?style=iframe&link= HTTP/1.1
                                                                                                                                                              Host: apphit.com
                                                                                                                                                              Connection: keep-alive
                                                                                                                                                              Upgrade-Insecure-Requests: 1
                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                                                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                                                                                                                              Sec-Fetch-Site: cross-site
                                                                                                                                                              Sec-Fetch-Mode: navigate
                                                                                                                                                              Sec-Fetch-Dest: document
                                                                                                                                                              sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"
                                                                                                                                                              sec-ch-ua-mobile: ?0
                                                                                                                                                              sec-ch-ua-platform: "Windows"
                                                                                                                                                              Referer: https://inside.bitcomet.com/
                                                                                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                                                                                              Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                                                                                                                              Cookie: XSRF-TOKEN=eyJpdiI6IllZdWd4SGgxeCtkeEZoazN3RlFWcVE9PSIsInZhbHVlIjoiUFRaT1VuWXNhNEtXZlluK1ZoR29qMXY5dDFpTTVXUWFkSXA2dGVtZ0llckxNZVNtVS9TcVNhK0ZnZWRFM2U4VnhJdDhBN0I5Y3ZMZTdXU2hTMXpGMzJrTjlsZGllQ1MzNEFWTTZLRUpTTnJTVU1kbmM0dytaT05pTzZITnpqblAiLCJtYWMiOiI1ODNkMmQ0Njk0NjhiMzE0ZWM0OWU5Y2RmOGRmMDI2ZDNkZTg4ZGY4NGMzZTQ1NGU1OTlmY2EwNGY2Yjk4ODZjIiwidGFnIjoiIn0%3D; apphit_session=eyJpdiI6IjNsamJxYVYza29BR0JyM2Z2ZzJvWWc9PSIsInZhbHVlIjoiWk9OQlZlditaSWxuVS9NVmVxRWtRQXVIcEtnam55VjZxdzFNMUxuMFVISjVYZEh6ZzRaZFBwK0dNR05hMXd6a0t6eWdiNDJDL2pPenpUTkJJUVgxMlRqN1cwMDVEcUJIYm4vSVNjckplM0w1RVArY3NsQm5NcnZvaDdDZFBBT1AiLCJtYWMiOiIyNjVkY2Y4MDQ2OWFlYjhhN2I3ODMwYTg3NjliM2YwODU0ZTIyN2QzNzM5ZGRlZGE3NmMxOTAxOTllZDY2MDU5IiwidGFnIjoiIn0%3D
                                                                                                                                                              2024-07-18 19:39:25 UTC1242INHTTP/1.1 200 OK
                                                                                                                                                              Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                              Content-Type: text/html; charset=UTF-8
                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                              Connection: close
                                                                                                                                                              Vary: Accept-Encoding
                                                                                                                                                              X-Frame-Options: GOFORIT
                                                                                                                                                              Cache-Control: no-cache, private
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:25 GMT
                                                                                                                                                              Set-Cookie: XSRF-TOKEN=eyJpdiI6IlRDUFdYME9ZcXBrM2hyNWNrYURDTEE9PSIsInZhbHVlIjoiQ2NPTmFwdzRQemwwOEQveERmMXBiYWJURnByZWljd1hKSEV0c1VSUWllQzZvSmRmdTJya05BSDREaVlEeVYxdWMrVEVUc2tGdS9GWUI1Vi8xYnJIZ2dHbzVLM1Bma3A1WXZzVzFsaTlFWHB5YUUxVE1sSUY5d0FxSGlOTWZNOGUiLCJtYWMiOiI5YjFkYmRlNmQxYWNmY2YwOGQ5NDIwNzFiYjg2MDIyMjUzZDJlOWI0ZmZlNmNkMGU3YjJiYmVhNzhiOTZmMzRmIiwidGFnIjoiIn0%3D; expires=Thu, 18 Jul 2024 21:39:25 GMT; Max-Age=7200; path=/; samesite=lax
                                                                                                                                                              Set-Cookie: apphit_session=eyJpdiI6Imc0WmF2ZDFDMjR5YTJOWG9tWG1MOGc9PSIsInZhbHVlIjoiQzc1OE00bCtvZzVUeW01ajlrVllXMkVCRDBuc1B5bFJwSHRWUUZKME5PeVYrbkpjSHByeU1Va1FlQ0lENTM2LzdiV1BnNDJnWi9IMVRwc0laaFU5KzVFWCtmNmZtNVZtT3dKMHdnT3g1Q2NUWHh0TDRUK0NPT0ZMMEdNOUhlWmsiLCJtYWMiOiI0Mzc4ZjEzZGJkMzc1ZGQwYzhmNzMwYTlkNjBhOWY4MzE2MjdhOTI2OTYwODk5OGIzZjljYWU2NjViZTE0YWJjIiwidGFnIjoiIn0%3D; expires=Thu, 18 Jul 2024 21:39:25 GMT; Max-Age=7200; path=/; httponly; samesite=lax
                                                                                                                                                              Strict-Transport-Security: max-age=15768000; preload
                                                                                                                                                              X-Content-Type-Options: nosniff
                                                                                                                                                              2024-07-18 19:39:25 UTC2253INData Raw: 38 63 31 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 3c 21 2d 2d 20 55 73 65 20 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 20 39 20 53 74 61 6e 64 61 72 64 73 20 6d 6f 64 65 20 2d 2d 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 39 22 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d
                                                                                                                                                              Data Ascii: 8c1<html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width,minimum-scale=1,initial-scale=1"> ... Use Internet Explorer 9 Standards mode --> <meta http-equiv="x-ua-compatible" content="IE=9"> <link rel=


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              23192.168.2.449799172.64.41.34433608C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:39:25 UTC245OUTPOST /dns-query HTTP/1.1
                                                                                                                                                              Host: chrome.cloudflare-dns.com
                                                                                                                                                              Connection: keep-alive
                                                                                                                                                              Content-Length: 128
                                                                                                                                                              Accept: application/dns-message
                                                                                                                                                              Accept-Language: *
                                                                                                                                                              User-Agent: Chrome
                                                                                                                                                              Accept-Encoding: identity
                                                                                                                                                              Content-Type: application/dns-message
                                                                                                                                                              2024-07-18 19:39:25 UTC128OUTData Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                              Data Ascii: wwwgstaticcom)TP
                                                                                                                                                              2024-07-18 19:39:25 UTC247INHTTP/1.1 200 OK
                                                                                                                                                              Server: cloudflare
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:25 GMT
                                                                                                                                                              Content-Type: application/dns-message
                                                                                                                                                              Connection: close
                                                                                                                                                              Access-Control-Allow-Origin: *
                                                                                                                                                              Content-Length: 468
                                                                                                                                                              CF-RAY: 8a54f00cc9294243-EWR
                                                                                                                                                              alt-svc: h3=":443"; ma=86400
                                                                                                                                                              2024-07-18 19:39:25 UTC468INData Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 26 00 04 8e fb 23 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                              Data Ascii: wwwgstaticcom&#)


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              24192.168.2.449800162.159.61.34433608C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:39:25 UTC245OUTPOST /dns-query HTTP/1.1
                                                                                                                                                              Host: chrome.cloudflare-dns.com
                                                                                                                                                              Connection: keep-alive
                                                                                                                                                              Content-Length: 128
                                                                                                                                                              Accept: application/dns-message
                                                                                                                                                              Accept-Language: *
                                                                                                                                                              User-Agent: Chrome
                                                                                                                                                              Accept-Encoding: identity
                                                                                                                                                              Content-Type: application/dns-message
                                                                                                                                                              2024-07-18 19:39:25 UTC128OUTData Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                              Data Ascii: wwwgstaticcom)TP
                                                                                                                                                              2024-07-18 19:39:25 UTC247INHTTP/1.1 200 OK
                                                                                                                                                              Server: cloudflare
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:25 GMT
                                                                                                                                                              Content-Type: application/dns-message
                                                                                                                                                              Connection: close
                                                                                                                                                              Access-Control-Allow-Origin: *
                                                                                                                                                              Content-Length: 468
                                                                                                                                                              CF-RAY: 8a54f00cec844398-EWR
                                                                                                                                                              alt-svc: h3=":443"; ma=86400
                                                                                                                                                              2024-07-18 19:39:25 UTC468INData Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0f 00 04 8e fb 28 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                              Data Ascii: wwwgstaticcom()


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              25192.168.2.449810172.183.192.1094433608C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:39:27 UTC607OUTPOST /api/browser/edge/navigate/3 HTTP/1.1
                                                                                                                                                              Host: nav-edge.smartscreen.microsoft.com
                                                                                                                                                              Connection: keep-alive
                                                                                                                                                              Content-Length: 1201
                                                                                                                                                              Authorization: SmartScreenHash eyJhdXRoSWQiOiJjMmU0ZjljYS1lZjYwLTQyY2EtOTAyZi1mNzgwZTFmMTk2YTciLCAia2V5IjoiL2R6S3ZyNE1Ua3UxWWNRR3V6eVBTUT09IiwgImhhc2giOiI1dy93RWx4MHV6MD0ifQ==
                                                                                                                                                              Content-Type: application/json; charset=utf-8
                                                                                                                                                              Sec-Fetch-Site: none
                                                                                                                                                              Sec-Fetch-Mode: no-cors
                                                                                                                                                              Sec-Fetch-Dest: empty
                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                                                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                                                                                              2024-07-18 19:39:27 UTC1201OUTData Raw: 7b 22 75 73 65 72 41 67 65 6e 74 22 3a 22 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 33 37 2e 33 36 20 28 4b 48 54 4d 4c 2c 20 6c 69 6b 65 20 47 65 63 6b 6f 29 20 43 68 72 6f 6d 65 2f 31 31 37 2e 30 2e 30 2e 30 20 53 61 66 61 72 69 2f 35 33 37 2e 33 36 20 45 64 67 2f 31 31 37 2e 30 2e 32 30 34 35 2e 34 37 22 2c 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f
                                                                                                                                                              Data Ascii: {"userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47","identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"lo
                                                                                                                                                              2024-07-18 19:39:27 UTC264INHTTP/1.1 200 OK
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:27 GMT
                                                                                                                                                              Content-Type: application/json; charset=utf-8
                                                                                                                                                              Content-Length: 1442
                                                                                                                                                              Connection: close
                                                                                                                                                              Server: Kestrel
                                                                                                                                                              Cache-Control: max-age=0, private
                                                                                                                                                              Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
                                                                                                                                                              2024-07-18 19:39:27 UTC1442INData Raw: 7b 22 61 63 74 69 6f 6e 73 22 3a 5b 7b 22 24 74 79 70 65 22 3a 22 63 61 63 68 65 22 2c 22 6b 65 79 22 3a 7b 22 75 72 69 22 3a 22 61 70 70 61 73 73 65 74 73 2e 62 69 74 63 6f 6d 65 74 2e 63 6f 6d 22 2c 22 69 6e 68 65 72 69 74 61 6e 63 65 22 3a 22 61 6c 6c 22 7d 2c 22 6d 61 78 41 67 65 22 3a 31 30 30 38 30 30 30 30 30 30 30 30 2c 22 73 65 72 76 65 72 43 6f 6e 74 65 78 74 22 3a 22 31 3b 63 35 66 61 61 64 35 39 2d 61 32 65 33 2d 33 31 66 32 2d 62 38 36 65 2d 61 61 66 39 35 38 65 31 32 38 32 34 3b 50 48 53 48 3a 30 30 35 3b 37 45 2d 30 35 22 2c 22 72 65 73 70 6f 6e 73 65 43 61 74 65 67 6f 72 79 22 3a 22 41 6c 6c 6f 77 65 64 22 2c 22 72 65 73 75 6c 74 22 3a 7b 22 24 74 79 70 65 22 3a 22 61 6c 6c 6f 77 22 7d 7d 2c 7b 22 24 74 79 70 65 22 3a 22 64 61 74 61 22 2c
                                                                                                                                                              Data Ascii: {"actions":[{"$type":"cache","key":{"uri":"appassets.bitcomet.com","inheritance":"all"},"maxAge":100800000000,"serverContext":"1;c5faad59-a2e3-31f2-b86e-aaf958e12824;PHSH:005;7E-05","responseCategory":"Allowed","result":{"$type":"allow"}},{"$type":"data",


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              26192.168.2.44981195.111.225.2114433608C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:39:27 UTC1350OUTGET /css/app.css HTTP/1.1
                                                                                                                                                              Host: apphit.com
                                                                                                                                                              Connection: keep-alive
                                                                                                                                                              sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"
                                                                                                                                                              sec-ch-ua-mobile: ?0
                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                                                                                                                              sec-ch-ua-platform: "Windows"
                                                                                                                                                              Accept: text/css,*/*;q=0.1
                                                                                                                                                              Sec-Fetch-Site: same-origin
                                                                                                                                                              Sec-Fetch-Mode: no-cors
                                                                                                                                                              Sec-Fetch-Dest: style
                                                                                                                                                              Referer: https://apphit.com/app/veracrypt?style=iframe&link=
                                                                                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                                                                                              Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                                                                                                                              Cookie: XSRF-TOKEN=eyJpdiI6IlRDUFdYME9ZcXBrM2hyNWNrYURDTEE9PSIsInZhbHVlIjoiQ2NPTmFwdzRQemwwOEQveERmMXBiYWJURnByZWljd1hKSEV0c1VSUWllQzZvSmRmdTJya05BSDREaVlEeVYxdWMrVEVUc2tGdS9GWUI1Vi8xYnJIZ2dHbzVLM1Bma3A1WXZzVzFsaTlFWHB5YUUxVE1sSUY5d0FxSGlOTWZNOGUiLCJtYWMiOiI5YjFkYmRlNmQxYWNmY2YwOGQ5NDIwNzFiYjg2MDIyMjUzZDJlOWI0ZmZlNmNkMGU3YjJiYmVhNzhiOTZmMzRmIiwidGFnIjoiIn0%3D; apphit_session=eyJpdiI6Imc0WmF2ZDFDMjR5YTJOWG9tWG1MOGc9PSIsInZhbHVlIjoiQzc1OE00bCtvZzVUeW01ajlrVllXMkVCRDBuc1B5bFJwSHRWUUZKME5PeVYrbkpjSHByeU1Va1FlQ0lENTM2LzdiV1BnNDJnWi9IMVRwc0laaFU5KzVFWCtmNmZtNVZtT3dKMHdnT3g1Q2NUWHh0TDRUK0NPT0ZMMEdNOUhlWmsiLCJtYWMiOiI0Mzc4ZjEzZGJkMzc1ZGQwYzhmNzMwYTlkNjBhOWY4MzE2MjdhOTI2OTYwODk5OGIzZjljYWU2NjViZTE0YWJjIiwidGFnIjoiIn0%3D
                                                                                                                                                              2024-07-18 19:39:28 UTC426INHTTP/1.1 200 OK
                                                                                                                                                              Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:27 GMT
                                                                                                                                                              Content-Type: text/css
                                                                                                                                                              Content-Length: 164401
                                                                                                                                                              Last-Modified: Fri, 05 Jan 2024 03:30:34 GMT
                                                                                                                                                              Connection: close
                                                                                                                                                              Vary: Accept-Encoding
                                                                                                                                                              ETag: "659777da-28231"
                                                                                                                                                              Expires: Fri, 19 Jul 2024 19:39:27 GMT
                                                                                                                                                              Cache-Control: max-age=86400
                                                                                                                                                              Strict-Transport-Security: max-age=15768000; preload
                                                                                                                                                              X-Content-Type-Options: nosniff
                                                                                                                                                              Accept-Ranges: bytes
                                                                                                                                                              2024-07-18 19:39:28 UTC15958INData Raw: 40 63 68 61 72 73 65 74 20 22 55 54 46 2d 38 22 3b 2e 6d 61 74 65 72 69 61 6c 69 7a 65 2d 72 65 64 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 35 31 63 32 33 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6d 61 74 65 72 69 61 6c 69 7a 65 2d 72 65 64 2d 74 65 78 74 7b 63 6f 6c 6f 72 3a 23 65 35 31 63 32 33 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6d 61 74 65 72 69 61 6c 69 7a 65 2d 72 65 64 2e 6c 69 67 68 74 65 6e 2d 35 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 64 65 61 65 62 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6d 61 74 65 72 69 61 6c 69 7a 65 2d 72 65 64 2d 74 65 78 74 2e 74 65 78 74 2d 6c 69 67 68 74 65 6e 2d 35 7b 63 6f 6c 6f 72 3a 23 66 64 65 61 65 62 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6d 61 74 65 72 69 61 6c 69 7a 65 2d 72 65 64 2e
                                                                                                                                                              Data Ascii: @charset "UTF-8";.materialize-red{background-color:#e51c23!important}.materialize-red-text{color:#e51c23!important}.materialize-red.lighten-5{background-color:#fdeaeb!important}.materialize-red-text.text-lighten-5{color:#fdeaeb!important}.materialize-red.
                                                                                                                                                              2024-07-18 19:39:28 UTC16384INData Raw: 6f 6c 6f 72 3a 23 61 35 64 36 61 37 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 67 72 65 65 6e 2e 6c 69 67 68 74 65 6e 2d 32 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 38 31 63 37 38 34 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 67 72 65 65 6e 2d 74 65 78 74 2e 74 65 78 74 2d 6c 69 67 68 74 65 6e 2d 32 7b 63 6f 6c 6f 72 3a 23 38 31 63 37 38 34 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 67 72 65 65 6e 2e 6c 69 67 68 74 65 6e 2d 31 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 36 36 62 62 36 61 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 67 72 65 65 6e 2d 74 65 78 74 2e 74 65 78 74 2d 6c 69 67 68 74 65 6e 2d 31 7b 63 6f 6c 6f 72 3a 23 36 36 62 62 36 61 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 67 72 65 65 6e 2e 64 61 72 6b 65 6e 2d 31 7b 62 61 63 6b 67 72 6f 75 6e 64
                                                                                                                                                              Data Ascii: olor:#a5d6a7!important}.green.lighten-2{background-color:#81c784!important}.green-text.text-lighten-2{color:#81c784!important}.green.lighten-1{background-color:#66bb6a!important}.green-text.text-lighten-1{color:#66bb6a!important}.green.darken-1{background
                                                                                                                                                              2024-07-18 19:39:28 UTC16384INData Raw: 72 74 61 6e 74 7d 2e 64 61 72 6b 65 6e 2d 33 2e 70 5f 6d 61 69 6e 5f 63 6f 6e 74 61 69 6e 65 72 2c 2e 67 72 65 79 2e 64 61 72 6b 65 6e 2d 33 2c 2e 70 5f 61 72 74 69 63 6c 65 20 2e 64 61 72 6b 65 6e 2d 33 2e 70 5f 61 6c 74 65 72 6e 61 74 69 76 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 34 32 34 32 34 32 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 67 72 65 79 2d 74 65 78 74 2e 74 65 78 74 2d 64 61 72 6b 65 6e 2d 33 2c 2e 70 5f 61 72 74 69 63 6c 65 20 2e 74 65 78 74 2d 64 61 72 6b 65 6e 2d 33 2e 70 5f 70 75 62 64 61 74 65 2c 2e 70 5f 62 72 65 61 64 63 72 75 6d 62 73 20 6c 69 2e 74 65 78 74 2d 64 61 72 6b 65 6e 2d 33 7b 63 6f 6c 6f 72 3a 23 34 32 34 32 34 32 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 64 61 72 6b 65 6e 2d 34 2e 70 5f 6d 61 69 6e 5f 63 6f 6e
                                                                                                                                                              Data Ascii: rtant}.darken-3.p_main_container,.grey.darken-3,.p_article .darken-3.p_alternative{background-color:#424242!important}.grey-text.text-darken-3,.p_article .text-darken-3.p_pubdate,.p_breadcrumbs li.text-darken-3{color:#424242!important}.darken-4.p_main_con
                                                                                                                                                              2024-07-18 19:39:28 UTC16384INData Raw: 2e 63 6f 6c 2e 70 75 6c 6c 2d 73 31 31 7b 72 69 67 68 74 3a 39 31 2e 36 36 36 36 36 36 36 36 36 37 25 7d 2e 72 6f 77 20 2e 63 6f 6c 2e 70 75 73 68 2d 73 31 31 7b 6c 65 66 74 3a 39 31 2e 36 36 36 36 36 36 36 36 36 37 25 7d 2e 72 6f 77 20 2e 63 6f 6c 2e 6f 66 66 73 65 74 2d 73 31 32 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 31 30 30 25 7d 2e 72 6f 77 20 2e 63 6f 6c 2e 70 75 6c 6c 2d 73 31 32 7b 72 69 67 68 74 3a 31 30 30 25 7d 2e 72 6f 77 20 2e 63 6f 6c 2e 70 75 73 68 2d 73 31 32 7b 6c 65 66 74 3a 31 30 30 25 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 77 69 64 74 68 3a 36 30 31 70 78 29 7b 2e 72 6f 77 20 2e 63 6f 6c 2e 6d 31 7b 77 69 64 74 68 3a 38 2e 33 33 33 33 33 33 33 33 33 33 25 7d 2e 72 6f 77 20 2e 63 6f 6c 2e
                                                                                                                                                              Data Ascii: .col.pull-s11{right:91.6666666667%}.row .col.push-s11{left:91.6666666667%}.row .col.offset-s12{margin-left:100%}.row .col.pull-s12{right:100%}.row .col.push-s12{left:100%}@media only screen and (min-width:601px){.row .col.m1{width:8.3333333333%}.row .col.
                                                                                                                                                              2024-07-18 19:39:28 UTC16384INData Raw: 6b 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 34 38 70 78 3b 68 65 69 67 68 74 3a 34 38 70 78 3b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 74 65 78 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 75 70 70 65 72 63 61 73 65 7d 2e 74 61 62 73 20 2e 74 61 62 20 61 7b 63 6f 6c 6f 72 3a 72 67 62 61 28 32 33 38 2c 31 31 30 2c 31 31 35 2c 2e 37 29 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 70 61 64 64 69 6e 67 3a 30 20 32 34 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 74 65 78 74 2d 6f 76 65 72 66 6c 6f 77 3a 65 6c 6c 69 70 73 69 73 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 63 6f 6c 6f 72
                                                                                                                                                              Data Ascii: k;text-align:center;line-height:48px;height:48px;padding:0;margin:0;text-transform:uppercase}.tabs .tab a{color:rgba(238,110,115,.7);display:block;width:100%;height:100%;padding:0 24px;font-size:14px;text-overflow:ellipsis;overflow:hidden;transition:color
                                                                                                                                                              2024-07-18 19:39:28 UTC16384INData Raw: 65 61 64 6f 6e 6c 79 5d 2b 6c 61 62 65 6c 2c 69 6e 70 75 74 5b 74 79 70 65 3d 6e 75 6d 62 65 72 5d 3a 6e 6f 74 28 2e 62 72 6f 77 73 65 72 2d 64 65 66 61 75 6c 74 29 3a 64 69 73 61 62 6c 65 64 2b 6c 61 62 65 6c 2c 69 6e 70 75 74 5b 74 79 70 65 3d 6e 75 6d 62 65 72 5d 3a 6e 6f 74 28 2e 62 72 6f 77 73 65 72 2d 64 65 66 61 75 6c 74 29 5b 72 65 61 64 6f 6e 6c 79 3d 72 65 61 64 6f 6e 6c 79 5d 2b 6c 61 62 65 6c 2c 69 6e 70 75 74 5b 74 79 70 65 3d 70 61 73 73 77 6f 72 64 5d 3a 6e 6f 74 28 2e 62 72 6f 77 73 65 72 2d 64 65 66 61 75 6c 74 29 3a 64 69 73 61 62 6c 65 64 2b 6c 61 62 65 6c 2c 69 6e 70 75 74 5b 74 79 70 65 3d 70 61 73 73 77 6f 72 64 5d 3a 6e 6f 74 28 2e 62 72 6f 77 73 65 72 2d 64 65 66 61 75 6c 74 29 5b 72 65 61 64 6f 6e 6c 79 3d 72 65 61 64 6f 6e 6c 79
                                                                                                                                                              Data Ascii: eadonly]+label,input[type=number]:not(.browser-default):disabled+label,input[type=number]:not(.browser-default)[readonly=readonly]+label,input[type=password]:not(.browser-default):disabled+label,input[type=password]:not(.browser-default)[readonly=readonly
                                                                                                                                                              2024-07-18 19:39:28 UTC16384INData Raw: 65 61 72 63 68 5d 7b 68 65 69 67 68 74 3a 69 6e 68 65 72 69 74 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 34 72 65 6d 3b 77 69 64 74 68 3a 63 61 6c 63 28 31 30 30 25 20 2d 20 34 72 65 6d 29 3b 62 6f 72 64 65 72 3a 30 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 7d 2e 69 6e 70 75 74 2d 66 69 65 6c 64 20 69 6e 70 75 74 5b 74 79 70 65 3d 73 65 61 72 63 68 5d 3a 66 6f 63 75 73 3a 6e 6f 74 28 2e 62 72 6f 77 73 65 72 2d 64 65 66 61 75 6c 74 29 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 62 6f 72 64 65 72 3a 30 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 63 6f 6c 6f 72 3a 23 34 34 34 7d 2e 69 6e 70 75 74 2d 66 69 65 6c 64 20 69 6e 70 75 74 5b 74 79 70 65 3d 73 65 61 72 63 68 5d 3a 66 6f 63 75 73 3a 6e 6f 74 28 2e 62 72 6f 77 73
                                                                                                                                                              Data Ascii: earch]{height:inherit;padding-left:4rem;width:calc(100% - 4rem);border:0;box-shadow:none}.input-field input[type=search]:focus:not(.browser-default){background-color:#fff;border:0;box-shadow:none;color:#444}.input-field input[type=search]:focus:not(.brows
                                                                                                                                                              2024-07-18 19:39:28 UTC16384INData Raw: 63 74 69 76 65 2c 2e 73 69 64 65 6e 61 76 2e 73 69 64 65 6e 61 76 2d 66 69 78 65 64 20 2e 63 6f 6c 6c 61 70 73 69 62 6c 65 2d 62 6f 64 79 3e 75 6c 3a 6e 6f 74 28 2e 63 6f 6c 6c 61 70 73 69 62 6c 65 29 3e 6c 69 2e 61 63 74 69 76 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 65 36 65 37 33 7d 2e 73 69 64 65 6e 61 76 20 2e 63 6f 6c 6c 61 70 73 69 62 6c 65 2d 62 6f 64 79 3e 75 6c 3a 6e 6f 74 28 2e 63 6f 6c 6c 61 70 73 69 62 6c 65 29 3e 6c 69 2e 61 63 74 69 76 65 20 61 2c 2e 73 69 64 65 6e 61 76 2e 73 69 64 65 6e 61 76 2d 66 69 78 65 64 20 2e 63 6f 6c 6c 61 70 73 69 62 6c 65 2d 62 6f 64 79 3e 75 6c 3a 6e 6f 74 28 2e 63 6f 6c 6c 61 70 73 69 62 6c 65 29 3e 6c 69 2e 61 63 74 69 76 65 20 61 7b 63 6f 6c 6f 72 3a 23 66 66 66 7d 2e 73 69 64 65 6e 61
                                                                                                                                                              Data Ascii: ctive,.sidenav.sidenav-fixed .collapsible-body>ul:not(.collapsible)>li.active{background-color:#ee6e73}.sidenav .collapsible-body>ul:not(.collapsible)>li.active a,.sidenav.sidenav-fixed .collapsible-body>ul:not(.collapsible)>li.active a{color:#fff}.sidena
                                                                                                                                                              2024-07-18 19:39:28 UTC16384INData Raw: 74 2d 73 69 7a 65 3a 33 65 6d 7d 2e 66 61 2d 34 78 7b 66 6f 6e 74 2d 73 69 7a 65 3a 34 65 6d 7d 2e 66 61 2d 35 78 7b 66 6f 6e 74 2d 73 69 7a 65 3a 35 65 6d 7d 2e 66 61 2d 66 77 7b 77 69 64 74 68 3a 31 2e 32 38 35 37 31 34 32 38 35 37 65 6d 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 66 61 2d 75 6c 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 30 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 32 2e 31 34 32 38 35 37 31 34 32 39 65 6d 3b 6c 69 73 74 2d 73 74 79 6c 65 2d 74 79 70 65 3a 6e 6f 6e 65 7d 2e 66 61 2d 75 6c 3e 6c 69 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 66 61 2d 6c 69 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6c 65 66 74 3a 2d 32 2e 31 34 32 38 35 37 31 34 32 39 65 6d 3b 77 69 64 74 68 3a 32 2e 31 34 32 38
                                                                                                                                                              Data Ascii: t-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-fw{width:1.2857142857em;text-align:center}.fa-ul{padding-left:0;margin-left:2.1428571429em;list-style-type:none}.fa-ul>li{position:relative}.fa-li{position:absolute;left:-2.1428571429em;width:2.1428
                                                                                                                                                              2024-07-18 19:39:28 UTC16384INData Raw: 6e 74 3a 22 5c 46 31 39 33 22 7d 2e 66 61 2d 76 69 6d 65 6f 2d 73 71 75 61 72 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 46 31 39 34 22 7d 2e 66 61 2d 74 72 79 3a 62 65 66 6f 72 65 2c 2e 66 61 2d 74 75 72 6b 69 73 68 2d 6c 69 72 61 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 46 31 39 35 22 7d 2e 66 61 2d 70 6c 75 73 2d 73 71 75 61 72 65 2d 6f 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 46 31 39 36 22 7d 2e 66 61 2d 73 70 61 63 65 2d 73 68 75 74 74 6c 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 46 31 39 37 22 7d 2e 66 61 2d 73 6c 61 63 6b 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 46 31 39 38 22 7d 2e 66 61 2d 65 6e 76 65 6c 6f 70 65 2d 73 71 75 61 72 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74
                                                                                                                                                              Data Ascii: nt:"\F193"}.fa-vimeo-square:before{content:"\F194"}.fa-try:before,.fa-turkish-lira:before{content:"\F195"}.fa-plus-square-o:before{content:"\F196"}.fa-space-shuttle:before{content:"\F197"}.fa-slack:before{content:"\F198"}.fa-envelope-square:before{content


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              27192.168.2.44981295.111.225.2114433608C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:39:27 UTC662OUTGET /image/app/veracrypt/veracrypt-logo.svg HTTP/1.1
                                                                                                                                                              Host: image.apphit.com
                                                                                                                                                              Connection: keep-alive
                                                                                                                                                              sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"
                                                                                                                                                              sec-ch-ua-mobile: ?0
                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                                                                                                                              sec-ch-ua-platform: "Windows"
                                                                                                                                                              Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                                                                                                                                                              Sec-Fetch-Site: same-site
                                                                                                                                                              Sec-Fetch-Mode: no-cors
                                                                                                                                                              Sec-Fetch-Dest: image
                                                                                                                                                              Referer: https://apphit.com/
                                                                                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                                                                                              Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                                                                                                                              2024-07-18 19:39:28 UTC357INHTTP/1.1 200 OK
                                                                                                                                                              Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:27 GMT
                                                                                                                                                              Content-Type: image/svg+xml
                                                                                                                                                              Content-Length: 2251
                                                                                                                                                              Last-Modified: Tue, 21 Jun 2022 13:17:49 GMT
                                                                                                                                                              Connection: close
                                                                                                                                                              Vary: Accept-Encoding
                                                                                                                                                              ETag: "62b1c4fd-8cb"
                                                                                                                                                              Strict-Transport-Security: max-age=15768000; preload
                                                                                                                                                              X-Content-Type-Options: nosniff
                                                                                                                                                              Accept-Ranges: bytes
                                                                                                                                                              2024-07-18 19:39:28 UTC2251INData Raw: 3c 73 76 67 20 69 64 3d 22 4c 61 79 65 72 5f 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 35 33 2e 31 20 33 31 39 2e 35 22 20 77 69 64 74 68 3d 22 32 35 30 30 22 20 68 65 69 67 68 74 3d 22 31 34 34 34 22 3e 3c 73 74 79 6c 65 3e 2e 73 74 30 7b 66 69 6c 6c 3a 23 32 30 61 63 64 39 7d 2e 73 74 31 7b 66 69 6c 6c 3a 23 32 37 61 37 64 34 7d 2e 73 74 32 7b 66 69 6c 6c 3a 23 32 35 39 65 64 32 7d 2e 73 74 33 7b 66 69 6c 6c 3a 23 32 61 38 65 63 65 7d 2e 73 74 34 7b 66 69 6c 6c 3a 23 33 30 38 38 63 38 7d 2e 73 74 35 7b 66 69 6c 6c 3a 23 33 35 37 61 62 65 7d 2e 73 74 36 7b 66 69 6c 6c 3a 23 33 61 36 64 62 33 7d 2e 73 74 37 7b 66 69 6c 6c 3a 23 32 32 36 39 37
                                                                                                                                                              Data Ascii: <svg id="Layer_1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 553.1 319.5" width="2500" height="1444"><style>.st0{fill:#20acd9}.st1{fill:#27a7d4}.st2{fill:#259ed2}.st3{fill:#2a8ece}.st4{fill:#3088c8}.st5{fill:#357abe}.st6{fill:#3a6db3}.st7{fill:#22697


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              28192.168.2.449815172.183.192.1094433608C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:39:28 UTC607OUTPOST /api/browser/edge/navigate/3 HTTP/1.1
                                                                                                                                                              Host: nav-edge.smartscreen.microsoft.com
                                                                                                                                                              Connection: keep-alive
                                                                                                                                                              Content-Length: 1258
                                                                                                                                                              Authorization: SmartScreenHash eyJhdXRoSWQiOiJjMmU0ZjljYS1lZjYwLTQyY2EtOTAyZi1mNzgwZTFmMTk2YTciLCAia2V5IjoiQmkrNEUzcStmdEJyeE9CeXV2YXpOUT09IiwgImhhc2giOiJQaUtDV2sxbktPYz0ifQ==
                                                                                                                                                              Content-Type: application/json; charset=utf-8
                                                                                                                                                              Sec-Fetch-Site: none
                                                                                                                                                              Sec-Fetch-Mode: no-cors
                                                                                                                                                              Sec-Fetch-Dest: empty
                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                                                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                                                                                              2024-07-18 19:39:28 UTC1258OUTData Raw: 7b 22 75 73 65 72 41 67 65 6e 74 22 3a 22 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 33 37 2e 33 36 20 28 4b 48 54 4d 4c 2c 20 6c 69 6b 65 20 47 65 63 6b 6f 29 20 43 68 72 6f 6d 65 2f 31 31 37 2e 30 2e 30 2e 30 20 53 61 66 61 72 69 2f 35 33 37 2e 33 36 20 45 64 67 2f 31 31 37 2e 30 2e 32 30 34 35 2e 34 37 22 2c 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f
                                                                                                                                                              Data Ascii: {"userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47","identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"lo
                                                                                                                                                              2024-07-18 19:39:29 UTC264INHTTP/1.1 200 OK
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:29 GMT
                                                                                                                                                              Content-Type: application/json; charset=utf-8
                                                                                                                                                              Content-Length: 1520
                                                                                                                                                              Connection: close
                                                                                                                                                              Server: Kestrel
                                                                                                                                                              Cache-Control: max-age=0, private
                                                                                                                                                              Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
                                                                                                                                                              2024-07-18 19:39:29 UTC1520INData Raw: 7b 22 61 63 74 69 6f 6e 73 22 3a 5b 7b 22 24 74 79 70 65 22 3a 22 63 61 63 68 65 22 2c 22 6b 65 79 22 3a 7b 22 75 72 69 22 3a 22 61 70 70 68 69 74 2e 63 6f 6d 3f 72 61 6e 64 6f 6d 3d 31 26 73 74 79 6c 65 3d 69 66 72 61 6d 65 22 2c 22 69 6e 68 65 72 69 74 61 6e 63 65 22 3a 22 6e 6f 6e 65 22 7d 2c 22 6d 61 78 41 67 65 22 3a 31 30 30 38 30 30 30 30 30 30 30 30 2c 22 73 65 72 76 65 72 43 6f 6e 74 65 78 74 22 3a 22 31 3b 66 39 34 63 30 32 35 66 2d 37 35 32 33 2d 36 39 37 32 2d 62 36 31 33 2d 63 65 32 63 32 34 36 63 35 35 63 65 3b 55 4e 4b 4e 3a 31 30 30 3b 30 2e 30 31 22 2c 22 72 65 73 70 6f 6e 73 65 43 61 74 65 67 6f 72 79 22 3a 22 41 6c 6c 6f 77 65 64 22 2c 22 72 65 73 75 6c 74 22 3a 7b 22 24 74 79 70 65 22 3a 22 65 76 61 6c 75 61 74 65 22 7d 7d 2c 7b 22 24
                                                                                                                                                              Data Ascii: {"actions":[{"$type":"cache","key":{"uri":"apphit.com?random=1&style=iframe","inheritance":"none"},"maxAge":100800000000,"serverContext":"1;f94c025f-7523-6972-b613-ce2c246c55ce;UNKN:100;0.01","responseCategory":"Allowed","result":{"$type":"evaluate"}},{"$


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              29192.168.2.449816142.250.65.2004433608C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:39:28 UTC607OUTGET /gtag/js?id=G-BE27VNW489 HTTP/1.1
                                                                                                                                                              Host: www.googletagmanager.com
                                                                                                                                                              Connection: keep-alive
                                                                                                                                                              sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"
                                                                                                                                                              sec-ch-ua-mobile: ?0
                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                                                                                                                              sec-ch-ua-platform: "Windows"
                                                                                                                                                              Accept: */*
                                                                                                                                                              Sec-Fetch-Site: cross-site
                                                                                                                                                              Sec-Fetch-Mode: no-cors
                                                                                                                                                              Sec-Fetch-Dest: script
                                                                                                                                                              Referer: https://apphit.com/
                                                                                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                                                                                              Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                                                                                                                              2024-07-18 19:39:29 UTC608INHTTP/1.1 200 OK
                                                                                                                                                              Content-Type: application/javascript; charset=UTF-8
                                                                                                                                                              Access-Control-Allow-Origin: *
                                                                                                                                                              Access-Control-Allow-Credentials: true
                                                                                                                                                              Access-Control-Allow-Headers: Cache-Control
                                                                                                                                                              Vary: Accept-Encoding
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:29 GMT
                                                                                                                                                              Expires: Thu, 18 Jul 2024 19:39:29 GMT
                                                                                                                                                              Cache-Control: private, max-age=900
                                                                                                                                                              Strict-Transport-Security: max-age=31536000; includeSubDomains
                                                                                                                                                              Cross-Origin-Resource-Policy: cross-origin
                                                                                                                                                              Server: Google Tag Manager
                                                                                                                                                              X-XSS-Protection: 0
                                                                                                                                                              Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                                                                                              Accept-Ranges: none
                                                                                                                                                              Connection: close
                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                              2024-07-18 19:39:29 UTC782INData Raw: 38 30 30 30 0d 0a 0a 2f 2f 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 32 20 47 6f 6f 67 6c 65 20 49 6e 63 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 0a 76 61 72 20 64 61 74 61 20 3d 20 7b 0a 22 72 65 73 6f 75 72 63 65 22 3a 20 7b 0a 20 20 22 76 65 72 73 69 6f 6e 22 3a 22 31 22 2c 0a 20 20 0a 20 20 22 6d 61 63 72 6f 73 22 3a 5b 7b 22 66 75 6e 63 74 69 6f 6e 22 3a 22 5f 5f 65 22 7d 2c 7b 22 76 74 70 5f 73 69 67 6e 61 6c 22 3a 30 2c 22 66 75 6e 63 74 69 6f 6e 22 3a 22 5f 5f 63 22 2c 22 76 74 70 5f 76 61 6c 75 65 22 3a 30 7d 2c 7b 22 66 75 6e 63 74 69 6f 6e 22 3a 22 5f 5f 63 22 2c 22 76 74 70 5f 76 61 6c 75 65 22 3a 22 22 7d 2c 7b 22 66 75 6e 63 74 69 6f 6e 22 3a 22 5f 5f 63 22 2c 22 76 74
                                                                                                                                                              Data Ascii: 8000// Copyright 2012 Google Inc. All rights reserved. (function(){var data = {"resource": { "version":"1", "macros":[{"function":"__e"},{"vtp_signal":0,"function":"__c","vtp_value":0},{"function":"__c","vtp_value":""},{"function":"__c","vt
                                                                                                                                                              2024-07-18 19:39:29 UTC1390INData Raw: 6d 61 69 6c 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 76 74 70 5f 70 6f 73 74 61 6c 43 6f 64 65 56 61 6c 75 65 22 3a 22 22 2c 22 76 74 70 5f 6c 61 73 74 4e 61 6d 65 56 61 6c 75 65 22 3a 22 22 2c 22 76 74 70 5f 70 68 6f 6e 65 54 79 70 65 22 3a 22 43 53 53 5f 53 45 4c 45 43 54 4f 52 22 2c 22 76 74 70 5f 70 68 6f 6e 65 56 61 6c 75 65 22 3a 22 22 2c 22 76 74 70 5f 73 74 72 65 65 74 54 79 70 65 22 3a 22 43 53 53 5f 53 45 4c 45 43 54 4f 52 22 2c 22 76 74 70 5f 61 75 74 6f 50 68 6f 6e 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 76 74 70 5f 70 6f 73 74 61 6c 43 6f 64 65 54 79 70 65 22 3a 22 43 53 53 5f 53 45 4c 45 43 54 4f 52 22 2c 22 76 74 70 5f 65 6d 61 69 6c 56 61 6c 75 65 22 3a 22 22 2c 22 76 74 70 5f 66 69 72 73 74 4e 61 6d 65 56 61 6c 75 65 22 3a
                                                                                                                                                              Data Ascii: mailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp_streetType":"CSS_SELECTOR","vtp_autoPhoneEnabled":false,"vtp_postalCodeType":"CSS_SELECTOR","vtp_emailValue":"","vtp_firstNameValue":
                                                                                                                                                              2024-07-18 19:39:29 UTC1390INData Raw: 76 74 70 5f 69 6e 63 6c 75 64 65 50 61 72 61 6d 73 22 3a 74 72 75 65 2c 22 76 74 70 5f 69 6e 73 74 61 6e 63 65 44 65 73 74 69 6e 61 74 69 6f 6e 49 64 22 3a 22 47 2d 42 45 32 37 56 4e 57 34 38 39 22 2c 22 74 61 67 5f 69 64 22 3a 32 30 7d 2c 7b 22 66 75 6e 63 74 69 6f 6e 22 3a 22 5f 5f 63 63 64 5f 65 6d 5f 6f 75 74 62 6f 75 6e 64 5f 63 6c 69 63 6b 22 2c 22 70 72 69 6f 72 69 74 79 22 3a 37 2c 22 76 74 70 5f 69 6e 63 6c 75 64 65 50 61 72 61 6d 73 22 3a 74 72 75 65 2c 22 76 74 70 5f 69 6e 73 74 61 6e 63 65 44 65 73 74 69 6e 61 74 69 6f 6e 49 64 22 3a 22 47 2d 42 45 32 37 56 4e 57 34 38 39 22 2c 22 74 61 67 5f 69 64 22 3a 31 39 7d 2c 7b 22 66 75 6e 63 74 69 6f 6e 22 3a 22 5f 5f 63 63 64 5f 65 6d 5f 70 61 67 65 5f 76 69 65 77 22 2c 22 70 72 69 6f 72 69 74 79 22
                                                                                                                                                              Data Ascii: vtp_includeParams":true,"vtp_instanceDestinationId":"G-BE27VNW489","tag_id":20},{"function":"__ccd_em_outbound_click","priority":7,"vtp_includeParams":true,"vtp_instanceDestinationId":"G-BE27VNW489","tag_id":19},{"function":"__ccd_em_page_view","priority"
                                                                                                                                                              2024-07-18 19:39:29 UTC1390INData Raw: 66 75 6e 63 74 69 6f 6e 22 3a 22 5f 5f 63 63 64 5f 67 61 5f 6c 61 73 74 22 2c 22 70 72 69 6f 72 69 74 79 22 3a 30 2c 22 76 74 70 5f 69 6e 73 74 61 6e 63 65 44 65 73 74 69 6e 61 74 69 6f 6e 49 64 22 3a 22 47 2d 42 45 32 37 56 4e 57 34 38 39 22 2c 22 74 61 67 5f 69 64 22 3a 31 32 7d 5d 2c 0a 20 20 22 70 72 65 64 69 63 61 74 65 73 22 3a 5b 7b 22 66 75 6e 63 74 69 6f 6e 22 3a 22 5f 65 71 22 2c 22 61 72 67 30 22 3a 5b 22 6d 61 63 72 6f 22 2c 30 5d 2c 22 61 72 67 31 22 3a 22 67 74 6d 2e 6a 73 22 7d 2c 7b 22 66 75 6e 63 74 69 6f 6e 22 3a 22 5f 65 71 22 2c 22 61 72 67 30 22 3a 5b 22 6d 61 63 72 6f 22 2c 30 5d 2c 22 61 72 67 31 22 3a 22 67 74 6d 2e 69 6e 69 74 22 7d 5d 2c 0a 20 20 22 72 75 6c 65 73 22 3a 5b 5b 5b 22 69 66 22 2c 30 5d 2c 5b 22 61 64 64 22 2c 31 34
                                                                                                                                                              Data Ascii: function":"__ccd_ga_last","priority":0,"vtp_instanceDestinationId":"G-BE27VNW489","tag_id":12}], "predicates":[{"function":"_eq","arg0":["macro",0],"arg1":"gtm.js"},{"function":"_eq","arg0":["macro",0],"arg1":"gtm.init"}], "rules":[[["if",0],["add",14
                                                                                                                                                              2024-07-18 19:39:29 UTC1390INData Raw: 2c 22 62 6e 22 5d 2c 22 73 65 61 72 63 68 22 5d 5d 2c 5b 36 35 2c 22 62 70 22 2c 5b 31 35 2c 22 62 6c 22 5d 2c 5b 34 36 2c 5b 35 33 2c 5b 35 32 2c 22 62 71 22 2c 5b 37 2c 5b 22 76 22 2c 5b 31 35 2c 22 62 70 22 5d 5d 2c 5b 22 77 22 2c 5b 31 35 2c 22 62 70 22 5d 5d 5d 5d 2c 5b 36 35 2c 22 62 72 22 2c 5b 31 35 2c 22 62 71 22 5d 2c 5b 34 36 2c 5b 35 33 2c 5b 35 32 2c 22 62 73 22 2c 5b 33 30 2c 5b 31 36 2c 5b 31 35 2c 22 74 22 5d 2c 5b 31 35 2c 22 62 72 22 5d 5d 2c 5b 34 33 2c 5b 31 35 2c 22 74 22 5d 2c 5b 31 35 2c 22 62 72 22 5d 2c 5b 22 62 22 2c 5b 30 2c 5b 30 2c 22 28 5b 3f 26 5d 22 2c 5b 31 35 2c 22 62 72 22 5d 5d 2c 22 3d 29 28 5b 5e 26 5d 2a 29 22 5d 2c 22 67 69 22 5d 5d 5d 5d 2c 5b 33 2c 22 62 6f 22 2c 5b 32 2c 5b 31 35 2c 22 62 6f 22 5d 2c 22 72 65 70
                                                                                                                                                              Data Ascii: ,"bn"],"search"]],[65,"bp",[15,"bl"],[46,[53,[52,"bq",[7,["v",[15,"bp"]],["w",[15,"bp"]]]],[65,"br",[15,"bq"],[46,[53,[52,"bs",[30,[16,[15,"t"],[15,"br"]],[43,[15,"t"],[15,"br"],["b",[0,[0,"([?&]",[15,"br"]],"=)([^&]*)"],"gi"]]]],[3,"bo",[2,[15,"bo"],"rep
                                                                                                                                                              2024-07-18 19:39:29 UTC1390INData Raw: 22 5d 2c 22 50 41 54 48 22 5d 5d 5d 2c 5b 34 36 2c 5b 35 33 2c 5b 35 32 2c 22 62 6e 22 2c 5b 22 7a 22 2c 5b 31 35 2c 22 62 6d 22 5d 2c 5b 31 35 2c 22 62 6c 22 5d 5d 5d 2c 5b 32 32 2c 5b 32 30 2c 5b 31 35 2c 22 62 6e 22 5d 2c 5b 34 34 5d 5d 2c 5b 34 36 2c 5b 33 36 2c 5b 31 35 2c 22 62 6d 22 5d 5d 5d 5d 2c 5b 35 32 2c 22 62 6f 22 2c 5b 31 37 2c 5b 31 35 2c 22 62 6e 22 5d 2c 22 73 65 61 72 63 68 22 5d 5d 2c 5b 35 32 2c 22 62 70 22 2c 5b 32 2c 5b 31 35 2c 22 62 6f 22 5d 2c 22 72 65 70 6c 61 63 65 22 2c 5b 37 2c 5b 31 35 2c 22 6f 22 5d 2c 5b 31 35 2c 22 72 22 5d 5d 5d 5d 2c 5b 32 32 2c 5b 32 30 2c 5b 31 35 2c 22 62 6f 22 5d 2c 5b 31 35 2c 22 62 70 22 5d 5d 2c 5b 34 36 2c 5b 33 36 2c 5b 31 35 2c 22 62 6d 22 5d 5d 5d 5d 2c 5b 34 33 2c 5b 31 35 2c 22 62 6e 22 5d
                                                                                                                                                              Data Ascii: "],"PATH"]]],[46,[53,[52,"bn",["z",[15,"bm"],[15,"bl"]]],[22,[20,[15,"bn"],[44]],[46,[36,[15,"bm"]]]],[52,"bo",[17,[15,"bn"],"search"]],[52,"bp",[2,[15,"bo"],"replace",[7,[15,"o"],[15,"r"]]]],[22,[20,[15,"bo"],[15,"bp"]],[46,[36,[15,"bm"]]]],[43,[15,"bn"]
                                                                                                                                                              2024-07-18 19:39:29 UTC1390INData Raw: 5d 5d 2c 5b 32 37 2c 31 5d 5d 2c 5b 34 36 2c 5b 32 2c 5b 31 35 2c 22 62 6d 22 5d 2c 22 70 75 73 68 22 2c 5b 37 2c 5b 31 35 2c 22 62 6c 22 5d 5d 5d 5d 5d 2c 5b 32 2c 5b 31 35 2c 22 62 6b 22 5d 2c 22 73 65 74 4d 65 74 61 64 61 74 61 22 2c 5b 37 2c 5b 31 35 2c 22 62 69 22 5d 2c 5b 31 35 2c 22 62 6d 22 5d 5d 5d 5d 2c 5b 35 32 2c 22 62 22 2c 5b 22 72 65 71 75 69 72 65 22 2c 22 69 6e 74 65 72 6e 61 6c 2e 63 72 65 61 74 65 52 65 67 65 78 22 5d 5d 2c 5b 35 32 2c 22 63 22 2c 5b 22 72 65 71 75 69 72 65 22 2c 22 64 65 63 6f 64 65 55 72 69 43 6f 6d 70 6f 6e 65 6e 74 22 5d 5d 2c 5b 35 32 2c 22 64 22 2c 5b 22 72 65 71 75 69 72 65 22 2c 22 65 6e 63 6f 64 65 55 72 69 43 6f 6d 70 6f 6e 65 6e 74 22 5d 5d 2c 5b 35 32 2c 22 65 22 2c 5b 31 33 2c 5b 34 31 2c 22 24 30 22 5d 2c
                                                                                                                                                              Data Ascii: ]],[27,1]],[46,[2,[15,"bm"],"push",[7,[15,"bl"]]]]],[2,[15,"bk"],"setMetadata",[7,[15,"bi"],[15,"bm"]]]],[52,"b",["require","internal.createRegex"]],[52,"c",["require","decodeUriComponent"]],[52,"d",["require","encodeUriComponent"]],[52,"e",[13,[41,"$0"],
                                                                                                                                                              2024-07-18 19:39:29 UTC1390INData Raw: 65 74 48 69 74 44 61 74 61 22 2c 5b 37 2c 5b 31 35 2c 22 62 6d 22 5d 5d 5d 5d 2c 5b 32 32 2c 5b 32 38 2c 5b 31 35 2c 22 62 6e 22 5d 5d 2c 5b 34 36 2c 5b 36 5d 5d 5d 2c 5b 35 32 2c 22 62 6f 22 2c 5b 22 62 63 22 2c 5b 31 35 2c 22 62 6d 22 5d 5d 5d 2c 5b 35 32 2c 22 62 70 22 2c 5b 22 62 64 22 2c 5b 31 35 2c 22 62 6e 22 5d 2c 5b 31 35 2c 22 62 6f 22 5d 5d 5d 2c 5b 32 32 2c 5b 32 31 2c 5b 31 35 2c 22 62 70 22 5d 2c 5b 34 34 5d 5d 2c 5b 34 36 2c 5b 32 2c 5b 31 35 2c 22 62 6b 22 5d 2c 22 73 65 74 48 69 74 44 61 74 61 22 2c 5b 37 2c 5b 31 35 2c 22 62 6d 22 5d 2c 5b 31 35 2c 22 62 70 22 5d 5d 5d 2c 5b 22 62 6a 22 2c 5b 31 35 2c 22 62 6b 22 5d 2c 5b 33 39 2c 5b 32 2c 5b 31 35 2c 22 62 6b 22 5d 2c 22 67 65 74 4d 65 74 61 64 61 74 61 22 2c 5b 37 2c 5b 31 35 2c 22 6d
                                                                                                                                                              Data Ascii: etHitData",[7,[15,"bm"]]]],[22,[28,[15,"bn"]],[46,[6]]],[52,"bo",["bc",[15,"bm"]]],[52,"bp",["bd",[15,"bn"],[15,"bo"]]],[22,[21,[15,"bp"],[44]],[46,[2,[15,"bk"],"setHitData",[7,[15,"bm"],[15,"bp"]]],["bj",[15,"bk"],[39,[2,[15,"bk"],"getMetadata",[7,[15,"m
                                                                                                                                                              2024-07-18 19:39:29 UTC1390INData Raw: 72 65 48 69 74 22 2c 5b 31 35 2c 22 6e 22 5d 5d 5d 2c 5b 36 35 2c 22 70 22 2c 5b 31 37 2c 5b 31 35 2c 22 61 22 5d 2c 22 63 6f 6e 76 65 72 73 69 6f 6e 52 75 6c 65 73 22 5d 2c 5b 34 36 2c 5b 32 32 2c 5b 22 63 22 2c 5b 31 37 2c 5b 31 35 2c 22 70 22 5d 2c 22 6d 61 74 63 68 69 6e 67 52 75 6c 65 73 22 5d 2c 5b 31 35 2c 22 6f 22 5d 5d 2c 5b 34 36 2c 5b 32 2c 5b 31 35 2c 22 6e 22 5d 2c 22 73 65 74 4d 65 74 61 64 61 74 61 22 2c 5b 37 2c 5b 31 35 2c 22 65 22 5d 2c 74 72 75 65 5d 5d 2c 5b 34 5d 5d 5d 5d 5d 2c 5b 32 32 2c 5b 32 2c 5b 31 35 2c 22 6e 22 5d 2c 22 67 65 74 4d 65 74 61 64 61 74 61 22 2c 5b 37 2c 5b 31 35 2c 22 66 22 5d 5d 5d 2c 5b 34 36 2c 5b 32 32 2c 5b 32 38 2c 5b 31 35 2c 22 6c 22 5d 5d 2c 5b 34 36 2c 5b 35 33 2c 5b 35 32 2c 22 70 22 2c 5b 22 62 22 2c
                                                                                                                                                              Data Ascii: reHit",[15,"n"]]],[65,"p",[17,[15,"a"],"conversionRules"],[46,[22,["c",[17,[15,"p"],"matchingRules"],[15,"o"]],[46,[2,[15,"n"],"setMetadata",[7,[15,"e"],true]],[4]]]]],[22,[2,[15,"n"],"getMetadata",[7,[15,"f"]]],[46,[22,[28,[15,"l"]],[46,[53,[52,"p",["b",
                                                                                                                                                              2024-07-18 19:39:29 UTC1390INData Raw: 2c 5b 30 2c 22 2f 22 2c 5b 31 37 2c 5b 31 35 2c 22 78 22 5d 2c 22 70 61 74 68 6e 61 6d 65 22 5d 5d 5d 5d 5d 2c 5b 35 30 2c 22 75 22 2c 5b 34 36 2c 22 78 22 5d 2c 5b 34 31 2c 22 79 22 5d 2c 5b 33 2c 22 79 22 2c 22 22 5d 2c 5b 32 32 2c 5b 31 2c 5b 31 35 2c 22 78 22 5d 2c 5b 31 37 2c 5b 31 35 2c 22 78 22 5d 2c 22 68 72 65 66 22 5d 5d 2c 5b 34 36 2c 5b 35 33 2c 5b 34 31 2c 22 7a 22 5d 2c 5b 33 2c 22 7a 22 2c 5b 32 2c 5b 31 37 2c 5b 31 35 2c 22 78 22 5d 2c 22 68 72 65 66 22 5d 2c 22 69 6e 64 65 78 4f 66 22 2c 5b 37 2c 22 23 22 5d 5d 5d 2c 5b 33 2c 22 79 22 2c 5b 33 39 2c 5b 32 33 2c 5b 31 35 2c 22 7a 22 5d 2c 30 5d 2c 5b 31 37 2c 5b 31 35 2c 22 78 22 5d 2c 22 68 72 65 66 22 5d 2c 5b 32 2c 5b 31 37 2c 5b 31 35 2c 22 78 22 5d 2c 22 68 72 65 66 22 5d 2c 22 73 75
                                                                                                                                                              Data Ascii: ,[0,"/",[17,[15,"x"],"pathname"]]]]],[50,"u",[46,"x"],[41,"y"],[3,"y",""],[22,[1,[15,"x"],[17,[15,"x"],"href"]],[46,[53,[41,"z"],[3,"z",[2,[17,[15,"x"],"href"],"indexOf",[7,"#"]]],[3,"y",[39,[23,[15,"z"],0],[17,[15,"x"],"href"],[2,[17,[15,"x"],"href"],"su


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              30192.168.2.449820172.183.192.1094433608C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:39:30 UTC734OUTPOST /api/browser/edge/data/toptraffic/3 HTTP/1.1
                                                                                                                                                              Host: data-edge.smartscreen.microsoft.com
                                                                                                                                                              Connection: keep-alive
                                                                                                                                                              Content-Length: 754
                                                                                                                                                              Accept: application/octet-stream;application/x-patch-bsdiff;
                                                                                                                                                              Authorization: SmartScreenHash eyJhdXRoSWQiOiJjMmU0ZjljYS1lZjYwLTQyY2EtOTAyZi1mNzgwZTFmMTk2YTciLCAia2V5IjoiamhZdUhSeUt2NkxSOVZrb08zSTRRQT09IiwgImhhc2giOiJnbWVMa0xJMk8zMD0ifQ==
                                                                                                                                                              Content-Type: application/json; charset=utf-8
                                                                                                                                                              If-None-Match: "170540185939602997400506234197983529371"
                                                                                                                                                              Sec-Fetch-Site: none
                                                                                                                                                              Sec-Fetch-Mode: no-cors
                                                                                                                                                              Sec-Fetch-Dest: empty
                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                                                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                                                                                              2024-07-18 19:39:30 UTC754OUTData Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b
                                                                                                                                                              Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
                                                                                                                                                              2024-07-18 19:39:31 UTC252INHTTP/1.1 200 OK
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:31 GMT
                                                                                                                                                              Content-Type: application/octet-stream
                                                                                                                                                              Content-Length: 460992
                                                                                                                                                              Connection: close
                                                                                                                                                              Server: Kestrel
                                                                                                                                                              ETag: "638004170464094982"
                                                                                                                                                              Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
                                                                                                                                                              2024-07-18 19:39:31 UTC16132INData Raw: 00 01 b7 32 6c 49 bd 35 18 3c 43 00 3b d3 7b 9a 00 08 16 f5 5f 2b 6a 45 e7 a6 60 9a c2 7d 9c 16 00 0c 2d 9e cc 04 23 e9 41 f4 82 16 a9 4b 52 db 00 0c 6c e3 4d 30 2c 73 87 bc fb 29 94 39 d4 c2 00 0c b4 d9 e2 eb e5 8f d8 b5 78 ca fa c6 82 9e 00 0c da 46 f1 62 1d cd 1e ab c5 cd 6a 55 ed dc 00 0e 79 d2 8a 68 27 a0 d5 e5 e5 89 bf 4c 3c 1f 00 12 2a 1f c4 5a 99 f8 2a 25 e9 2a 92 1a f6 5f 00 14 b2 67 12 34 79 75 12 bc d6 99 a8 99 1c cc 00 14 c8 bf 10 27 63 3d b9 cd 49 30 99 bf d3 a1 00 17 f8 9d 81 a3 94 71 57 f8 bf 3c 3a 4e ba d2 00 1a 3c bc a6 55 f9 2c 4d 69 94 e9 c9 5f b9 8c 00 1f 17 b3 27 28 0e f5 55 df 39 10 21 05 ce 96 00 1f bc ff bf d8 75 92 d1 13 89 37 0b 86 dc 34 00 20 98 bc 45 61 f8 b8 0d 34 2e 2b fb 37 39 6b 00 21 54 ca 2d 35 57 fb 9f 21 b8 d7 9a 40 2b
                                                                                                                                                              Data Ascii: 2lI5<C;{_+jE`}-#AKRlM0,s)9xFbjUyh'L<*Z*%*_g4yu'c=I0qW<:N<U,Mi_'(U9!u74 Ea4.+79k!T-5W!@+
                                                                                                                                                              2024-07-18 19:39:31 UTC16384INData Raw: b8 6c 65 b5 81 d7 e8 96 a2 f6 fb f5 08 e9 4a 27 41 5a ef 9e 20 88 b1 dd 92 43 f1 c7 08 f6 31 2a b4 6b b0 d0 7b af f2 6e c0 3b 30 49 08 f7 14 46 2e c2 8e a1 9b 56 f6 89 ff 89 a1 a1 08 f8 86 49 94 74 f7 df c7 92 d3 f1 d5 09 db a4 08 f9 bb 85 2c 48 b7 6a b2 fe 9c 06 4c 91 ba af 08 fb 12 e5 67 95 f2 51 95 31 42 c4 14 92 6c 77 08 fb aa 20 c5 0c 96 4a 9a 6f 2e 40 d4 2b fd 90 08 fe aa 92 f9 b3 b3 8f b8 65 27 9b b9 df 14 f7 09 00 34 db 44 0d dd 66 70 53 8f 0b 31 18 8b ba 09 05 38 28 fa 80 5f eb 56 83 46 d1 dd 83 34 b7 09 06 35 0d 42 c1 3f 91 ee 97 ed f4 31 68 37 32 09 08 35 c9 14 24 10 2f b5 80 ac f7 9a 16 e6 e2 09 08 7a 82 38 a3 08 0b 00 2c 62 9c d0 2e d2 c4 09 09 d1 da a7 a8 16 cd 89 e5 ac fe b9 cc 8e 69 09 0e 20 d3 38 58 e2 6b 84 a1 e7 75 97 ad 75 61 09 0e 4d
                                                                                                                                                              Data Ascii: leJ'AZ C1*k{n;0IF.VIt,HjLgQ1Blw Jo.@+e'4DfpS18(_VF45B?1h725$/z8,b.i 8XkuuaM
                                                                                                                                                              2024-07-18 19:39:31 UTC16384INData Raw: 88 ca 0d 74 ff b7 03 d5 0b 17 29 2e 12 86 39 8d 65 51 d1 6b 43 f6 37 a6 5e 4e 7e d5 12 8c a6 4c a1 b4 9a f4 6b 69 49 eb 0d 33 90 eb 12 8f 60 36 ec 98 cd 7f 6a 59 fe c5 d1 d5 4b 38 12 92 da 96 3e 8a fd ee fb c5 ac d0 29 b4 8e 13 12 95 25 87 d8 33 f2 c0 16 e8 0f 63 67 d6 78 d1 12 96 03 01 99 d8 95 ea 2c 0a f8 85 62 05 db 93 12 96 52 aa 59 60 de e6 e9 8c 23 d4 b7 c1 34 3d 12 96 bf ae d0 b9 c2 92 db f1 41 07 61 b1 82 5d 12 97 53 89 b5 7c fd 88 82 19 c7 b1 b0 0f af ed 12 98 30 32 6a a5 03 4e 26 db 95 be 1b a9 a3 e2 12 9a ea fe 35 92 c8 f4 3b 7a 18 36 80 cb 78 bf 12 9b 33 a3 9e d9 7b 54 c8 7b da 3b ed a8 dd 25 12 9b 98 d3 83 cc 49 8e 52 58 13 7e 3f 04 d9 af 12 9c 0d 11 dc 93 65 32 c4 f0 f6 a9 12 25 13 25 12 9c 28 31 10 8a f9 38 40 df 1f 08 9f 08 d4 71 12 9f 71
                                                                                                                                                              Data Ascii: t).9eQkC7^N~LkiI3`6jYK8>)%3cgx,bRY`#4=Aa]S|02jN&5;z6x3{T{;%IRX~?e2%%(18@qq
                                                                                                                                                              2024-07-18 19:39:31 UTC16384INData Raw: 8c e6 1b 88 d1 53 7d a1 f2 bc f6 d3 1b bd 38 be aa 88 bb f2 1c 05 de ac 2c b3 63 c3 1b bf d8 bc e5 a8 4c 42 a1 5e 7d 76 56 07 18 dd 1b c1 05 6e 7a a0 f3 27 8e eb 4f 29 e6 e0 a0 2a 1b c2 a1 45 60 4f 19 d0 fa 94 66 c2 31 56 e0 ac 1b c3 58 61 04 7c 91 76 1b 27 0c 2e 05 4d 26 17 1b c4 0f 81 e0 48 ff 13 e9 e7 fd ae 77 76 47 85 1b c5 d5 9a 68 ef 46 53 52 de 8b 1c 3a 7b 4f 53 1b cc c2 c4 df 4d dc 18 9f 1a a6 aa 47 f5 9f 2e 1b cd 8c 32 11 55 08 6c 9c 2f 0b 09 34 58 ca d2 1b cf 2c 48 15 0b dd b9 a9 cc 90 e8 14 76 e1 c7 1b d1 50 e1 1f 03 b2 ff 0f ab b3 c3 a2 cf c2 1a 1b d6 7a 97 41 b9 a0 2a 37 7b ba 9a 0a 00 47 56 1b da a2 08 31 23 96 3c 24 0a b0 10 2f 5e b6 c3 1b dc 15 6b ce f9 b8 64 db f8 fb 84 2a d6 02 9b 1b dc 58 1e e3 44 3f fb c2 e7 7f 97 d4 41 5f 1c 1b dc 83
                                                                                                                                                              Data Ascii: S}8,cLB^}vVnz'O)*E`Of1VXa|v'.M&HwvGhFSR:{OSMG.2Ul/4X,HvPzA*7{GV1#<$/^kd*XD?A_
                                                                                                                                                              2024-07-18 19:39:31 UTC16384INData Raw: 9c f0 8f 05 68 32 cf 23 af 0f e9 31 25 17 e2 83 8c a0 e0 45 41 22 69 ae 51 16 97 9e 25 19 94 88 65 65 22 da 5c e4 68 67 07 cf 5f 7a 25 1e 6a 2e 6e bf 40 39 a7 91 dd 9f 82 5c b4 be 25 21 01 14 90 ab fe fa c5 d4 0a 62 0b cd 30 e1 25 21 03 7a 48 db 3d 1f b8 bc 66 91 12 c8 41 7f 25 24 00 6f 09 69 7b 22 bc d0 5a 82 9d c8 cb 00 25 24 76 95 60 1f 20 bf 51 8e ef 43 af 74 27 17 25 24 d0 90 ec 4d 35 f3 3b 75 d1 b6 56 62 63 3e 25 25 bd 14 86 f0 f0 dc 12 c9 55 32 f1 85 66 4f 25 25 de ea a2 0c 7b b9 31 02 c3 fc 10 0f 92 23 25 27 0a 2e 12 37 63 79 36 e7 03 6f 4c 1e 67 7e 25 29 ef 20 dd 60 cb e0 1f 91 82 96 c4 38 ef d3 25 2c 0d 19 1e 65 a3 27 9b 58 e2 44 e3 80 93 37 25 2c e2 18 e3 78 51 0e b2 f9 62 26 e5 78 8f 9f 25 36 84 bd bb 8f cc a6 bc 42 a8 bf 22 b0 f1 a9 25 3a 54
                                                                                                                                                              Data Ascii: h2#1%EA"iQ%ee"\hg_z%j.n@9\%!b0%!zH=fA%$oi{"Z%$v` QCt'%$M5;uVbc>%%U2fO%%{1#%'.7cy6oLg~%) `8%,e'XD7%,xQb&x%6B"%:T
                                                                                                                                                              2024-07-18 19:39:31 UTC16384INData Raw: b6 07 8f 44 9d 29 36 4f 29 8a 7d 80 2e 1d 98 b7 c7 17 54 cd a1 2b c2 e9 29 21 98 f9 2e 1f 4a 0d ee 13 3f 5a 00 ff e7 0d f0 d4 1c 86 2e 21 27 d4 ff 4a 83 22 1e 86 3f 93 6b 62 a1 0e 2e 25 e1 37 a1 70 d4 f6 b3 17 bd e9 dd 8d 2a 44 2e 26 32 0d f4 82 4c f6 14 9e 97 92 23 fa 52 37 2e 2a 40 96 f4 4d 34 89 21 f2 49 39 e8 d3 d3 19 2e 2b ef 39 f1 8a 4a 7e 28 b9 d0 be 00 6f 35 68 2e 2e 95 d3 bd e3 e7 a0 d6 d0 25 5e 0d b7 b5 a5 2e 31 ce 53 a9 54 e0 3b 3c 2f fc 4d eb 0f a5 e1 2e 33 1e 46 e8 3a 01 30 91 17 49 f3 33 11 46 79 2e 36 b7 bb 07 e4 6d 92 d5 42 49 d7 e5 49 f4 85 2e 36 e8 96 57 36 97 bb 40 7a 3b ca 8a e0 7e 53 2e 3a 1e f2 97 75 d6 ae 4f f5 85 eb 36 38 65 e5 2e 3a 59 df c9 6e 75 92 ac 40 ac 59 a6 fd e4 1c 2e 3b 8e 5c 94 1d 75 39 54 06 13 6b 6e 7f ef 30 2e 43 e8
                                                                                                                                                              Data Ascii: D)6O)}.T+)!.J?Z.!'J"?kb.%7p*D.&2L#R7.*@M4!I9.+9J~(o5h..%^.1ST;</M.3F:0I3Fy.6mBII.6W6@z;~S.:uO68e.:Ynu@Y.;\u9Tkn0.C
                                                                                                                                                              2024-07-18 19:39:31 UTC16384INData Raw: 02 f3 ca e4 05 cb a0 be 15 69 62 32 37 3c 37 3b db 81 8a b2 df cf ef b1 79 3f f8 ae 37 3d a3 01 e8 95 76 a1 63 78 77 2e 93 42 3d 4f 37 3e c4 08 a5 37 4f 84 43 dc 19 00 a9 8f 2e 0d 37 3f 82 55 cb cd 06 b9 0c 0d 94 f9 4f d6 82 e8 37 44 09 28 b8 33 ef b7 ee 6b 4c 90 ee e0 d1 3a 37 44 83 9a 56 2d 6a 58 ea 6b e5 8f 6a 1d 17 23 37 47 0f 55 f8 2b 1c 30 89 3a 1d e2 21 89 b7 42 37 4b 86 38 d0 cd 9f 96 62 d8 da bf d5 15 ed cb 37 4e 81 34 2b 0e ea ab 6f ae 29 15 59 32 ae 46 37 50 d2 0c 2a e2 ca 59 ec 21 86 70 f9 7a 6c d1 37 55 32 b2 91 f0 e7 b8 47 d0 f7 0f 64 90 d9 51 37 56 ce 44 24 61 58 d7 f8 d4 0d 8b fe 3d b0 27 37 58 1f 24 d2 a5 24 9c d7 5c 5a 71 f9 e9 f2 a3 37 58 9d d0 f0 06 3a 05 be 08 d9 90 bc 18 0d 71 37 5d 04 71 81 05 8e b6 9b 24 f2 54 35 1b 18 46 37 62 eb
                                                                                                                                                              Data Ascii: ib27<7;y?7=vcxw.B=O7>7OC.7?UO7D(3kL:7DV-jXkj#7GU+0:!B7K8b7N4+o)Y2F7P*Y!pzl7U2GdQ7VD$aX='7X$$\Zq7X:q7]q$T5F7b
                                                                                                                                                              2024-07-18 19:39:31 UTC16384INData Raw: 30 9b b9 2f 98 88 40 3b cc 98 d2 59 40 6d c4 d7 67 2a f1 8a f6 d5 d3 92 a9 c6 13 1d 40 71 5f 29 26 14 e2 86 f2 b1 3c d6 fc 07 07 4a 40 77 d4 86 06 be 80 6f b2 fd e4 19 fe 6b 6a 94 40 78 4d f5 b9 67 58 78 83 29 63 04 29 22 98 8d 40 7a 85 3f 10 18 78 19 d3 be 45 8d 0e 49 7b bb 40 7b 5d c5 55 97 e5 9d 35 9d 27 93 51 1d be 21 40 7d 42 88 f1 ca 9d ba 2a 28 3a f8 72 71 ba c7 40 7e 4d cf f4 13 b8 8f f1 9c e6 e4 a8 50 74 d0 40 80 bb 51 db 04 52 b7 b2 f3 5f dc db 6d 4b de 40 88 e2 91 a0 6c 67 8c d2 0b 9f d2 91 ca 6d 22 40 8a b9 d3 6a f9 07 64 05 ea 52 dc 44 82 0b 38 40 8b 54 ce 67 df 8c a3 48 2d 96 f6 ed e4 cf 78 40 8e 78 fd f9 d7 db ac 12 a0 80 27 db 9f 14 42 40 90 00 78 66 ff 66 2b 58 9f 18 13 aa 3d 6e b3 40 90 fa a1 0b 8e ee 2b 73 4b 59 c6 c9 b1 84 9b 40 93 53
                                                                                                                                                              Data Ascii: 0/@;Y@mg*@q_)&<J@wokj@xMgXx)c)"@z?xEI{@{]U5'Q!@}B*(:rq@~MPt@QR_mK@lgm"@jdRD8@TgH-x@x'B@xff+X=n@+sKY@S
                                                                                                                                                              2024-07-18 19:39:31 UTC16384INData Raw: 66 82 7d 26 60 5e 84 ec 72 2a af 39 49 bb 12 c2 0a 6a 68 a1 f1 aa 3c 93 f9 79 13 0e 49 bb 81 dd 8c 7e 5d 19 6b 54 60 33 c1 1e 70 56 49 bc df 84 ed 14 a3 5d 07 06 25 84 6a 95 02 e0 49 bd eb 48 24 83 1e f1 e0 29 fe 9e e6 22 da 07 49 c1 2d 65 e8 79 f6 32 c8 9b 5b 3f 1a a8 9d b9 49 c4 33 af 97 7a e9 a1 ba ed 12 d0 a3 40 1e 42 49 c5 09 f1 9f 2c bb 61 75 14 cf 80 9c 0e 85 9e 49 c8 81 16 cb ae 60 54 25 eb 75 fe e4 b5 16 8c 49 cc 62 7c 10 80 46 f7 71 86 18 7b bd ea 45 5f 49 cd ad e9 e7 ee e9 a2 7e 24 2e 10 93 70 b0 ad 49 d1 bc ac 01 05 b1 9b be b4 f8 4e e6 0c 0d ac 49 d2 4b be 25 0a bd 70 d0 f7 10 c2 d7 38 8b f2 49 d4 c5 71 4c 7f 7a 2a 83 c3 c3 50 d2 c2 4c 3e 49 d5 40 eb ee b7 40 f4 16 fe b4 e7 35 d0 25 e3 49 d6 e7 89 68 04 ba a1 f5 37 3f 51 0a 5e cc 25 49 da b4
                                                                                                                                                              Data Ascii: f}&`^r*9Ijh<yI~]kT`3pVI]%jIH$)"I-ey2[?I3z@BI,auI`T%uIb|Fq{E_I~$.pINIK%p8IqLz*PL>I@@5%Ih7?Q^%I


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              31192.168.2.449823172.183.192.1094433608C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:39:31 UTC724OUTPOST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1
                                                                                                                                                              Host: data-edge.smartscreen.microsoft.com
                                                                                                                                                              Connection: keep-alive
                                                                                                                                                              Content-Length: 1129
                                                                                                                                                              Accept: application/octet-stream;application/x-patch-bsdiff;
                                                                                                                                                              Authorization: SmartScreenHash eyJhdXRoSWQiOiJjMmU0ZjljYS1lZjYwLTQyY2EtOTAyZi1mNzgwZTFmMTk2YTciLCAia2V5IjoiODRuR2ZNbnhWUG9VaE9ZMlFmaHNPdz09IiwgImhhc2giOiJrQk5Rayt3Vlk0TT0ifQ==
                                                                                                                                                              Content-Type: application/json; charset=utf-8
                                                                                                                                                              If-None-Match: "636976985063396749.rel.v2"
                                                                                                                                                              Sec-Fetch-Site: none
                                                                                                                                                              Sec-Fetch-Mode: no-cors
                                                                                                                                                              Sec-Fetch-Dest: empty
                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                                                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                                                                                              2024-07-18 19:39:31 UTC1129OUTData Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 22 74 3d 47 77 41 57 41 64 39 74 42 41 41 55 61 6e 50 58 4e 73 70 50 47 6c 43 51 4a 6d 46 67 65 2b 54 4b 36 55 38 36 57 57 55 4f 5a 67 41 41 45 4a 68 45 6a 34 5a 57 36 53 6e 48 6a 62 6e 4a 6e 77 55 51 65 53 33 67 41 4a 47 34 6e 58 71 4f 6f 6b 67 42 4c 69 74 68 57 55 34 71 75 33 63 55 4d 32 6d 5a 71 37 58 39 31 6d 50 6d 66 52 70 61 4c 6f 4e 6d 36 6f 7a 51 34 47 65 59 50 50 6f 69 49 36 42 49 58 38 37 33 66 6f 31 50 4f 54 68 6d 6a 4c 6d 66 75 70 52 68 41 79 6a 47 69 41 62 4d 6d 56 4e 31
                                                                                                                                                              Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":"t=GwAWAd9tBAAUanPXNspPGlCQJmFge+TK6U86WWUOZgAAEJhEj4ZW6SnHjbnJnwUQeS3gAJG4nXqOokgBLithWU4qu3cUM2mZq7X91mPmfRpaLoNm6ozQ4GeYPPoiI6BIX873fo1POThmjLmfupRhAyjGiAbMmVN1
                                                                                                                                                              2024-07-18 19:39:31 UTC248INHTTP/1.1 200 OK
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:31 GMT
                                                                                                                                                              Content-Type: application/octet-stream
                                                                                                                                                              Content-Length: 57
                                                                                                                                                              Connection: close
                                                                                                                                                              Server: Kestrel
                                                                                                                                                              ETag: "638343870221005468"
                                                                                                                                                              Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
                                                                                                                                                              2024-07-18 19:39:31 UTC57INData Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d
                                                                                                                                                              Data Ascii: 9murmur3,MhZ8\<&LiH[?m


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              32192.168.2.449824172.183.192.1094433608C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:39:31 UTC699OUTPOST /api/browser/edge/data/settings/3 HTTP/1.1
                                                                                                                                                              Host: data-edge.smartscreen.microsoft.com
                                                                                                                                                              Connection: keep-alive
                                                                                                                                                              Content-Length: 1129
                                                                                                                                                              Accept: application/octet-stream;application/x-patch-bsdiff;
                                                                                                                                                              Authorization: SmartScreenHash eyJhdXRoSWQiOiJjMmU0ZjljYS1lZjYwLTQyY2EtOTAyZi1mNzgwZTFmMTk2YTciLCAia2V5IjoiODRuR2ZNbnhWUG9VaE9ZMlFmaHNPdz09IiwgImhhc2giOiJrQk5Rayt3Vlk0TT0ifQ==
                                                                                                                                                              Content-Type: application/json; charset=utf-8
                                                                                                                                                              If-None-Match: "2.0-0"
                                                                                                                                                              Sec-Fetch-Site: none
                                                                                                                                                              Sec-Fetch-Mode: no-cors
                                                                                                                                                              Sec-Fetch-Dest: empty
                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                                                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                                                                                              2024-07-18 19:39:31 UTC1129OUTData Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 22 74 3d 47 77 41 57 41 64 39 74 42 41 41 55 61 6e 50 58 4e 73 70 50 47 6c 43 51 4a 6d 46 67 65 2b 54 4b 36 55 38 36 57 57 55 4f 5a 67 41 41 45 4a 68 45 6a 34 5a 57 36 53 6e 48 6a 62 6e 4a 6e 77 55 51 65 53 33 67 41 4a 47 34 6e 58 71 4f 6f 6b 67 42 4c 69 74 68 57 55 34 71 75 33 63 55 4d 32 6d 5a 71 37 58 39 31 6d 50 6d 66 52 70 61 4c 6f 4e 6d 36 6f 7a 51 34 47 65 59 50 50 6f 69 49 36 42 49 58 38 37 33 66 6f 31 50 4f 54 68 6d 6a 4c 6d 66 75 70 52 68 41 79 6a 47 69 41 62 4d 6d 56 4e 31
                                                                                                                                                              Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":"t=GwAWAd9tBAAUanPXNspPGlCQJmFge+TK6U86WWUOZgAAEJhEj4ZW6SnHjbnJnwUQeS3gAJG4nXqOokgBLithWU4qu3cUM2mZq7X91mPmfRpaLoNm6ozQ4GeYPPoiI6BIX873fo1POThmjLmfupRhAyjGiAbMmVN1
                                                                                                                                                              2024-07-18 19:39:31 UTC302INHTTP/1.1 200 OK
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:31 GMT
                                                                                                                                                              Content-Type: application/octet-stream
                                                                                                                                                              Content-Length: 130439
                                                                                                                                                              Connection: close
                                                                                                                                                              Server: Kestrel
                                                                                                                                                              ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1"
                                                                                                                                                              Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
                                                                                                                                                              2024-07-18 19:39:31 UTC16082INData Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a
                                                                                                                                                              Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
                                                                                                                                                              2024-07-18 19:39:32 UTC16384INData Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20
                                                                                                                                                              Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
                                                                                                                                                              2024-07-18 19:39:32 UTC16384INData Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a
                                                                                                                                                              Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
                                                                                                                                                              2024-07-18 19:39:32 UTC16384INData Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61
                                                                                                                                                              Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
                                                                                                                                                              2024-07-18 19:39:32 UTC16384INData Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63
                                                                                                                                                              Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
                                                                                                                                                              2024-07-18 19:39:32 UTC16384INData Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20
                                                                                                                                                              Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
                                                                                                                                                              2024-07-18 19:39:32 UTC16384INData Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a
                                                                                                                                                              Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
                                                                                                                                                              2024-07-18 19:39:32 UTC16053INData Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d
                                                                                                                                                              Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              33192.168.2.449825172.183.192.1094433608C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:39:32 UTC607OUTPOST /api/browser/edge/navigate/3 HTTP/1.1
                                                                                                                                                              Host: nav-edge.smartscreen.microsoft.com
                                                                                                                                                              Connection: keep-alive
                                                                                                                                                              Content-Length: 1643
                                                                                                                                                              Authorization: SmartScreenHash eyJhdXRoSWQiOiJjMmU0ZjljYS1lZjYwLTQyY2EtOTAyZi1mNzgwZTFmMTk2YTciLCAia2V5IjoiYWVKQ0M0NjNpYzJlbjM1SmFqTTEzQT09IiwgImhhc2giOiIzS3F3WklmQ0lCZz0ifQ==
                                                                                                                                                              Content-Type: application/json; charset=utf-8
                                                                                                                                                              Sec-Fetch-Site: none
                                                                                                                                                              Sec-Fetch-Mode: no-cors
                                                                                                                                                              Sec-Fetch-Dest: empty
                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                                                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                                                                                              2024-07-18 19:39:32 UTC1643OUTData Raw: 7b 22 75 73 65 72 41 67 65 6e 74 22 3a 22 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 33 37 2e 33 36 20 28 4b 48 54 4d 4c 2c 20 6c 69 6b 65 20 47 65 63 6b 6f 29 20 43 68 72 6f 6d 65 2f 31 31 37 2e 30 2e 30 2e 30 20 53 61 66 61 72 69 2f 35 33 37 2e 33 36 20 45 64 67 2f 31 31 37 2e 30 2e 32 30 34 35 2e 34 37 22 2c 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 22 74 3d 47 77 41 57 41 64 39 74 42 41 41 55 61 6e 50 58
                                                                                                                                                              Data Ascii: {"userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47","identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":"t=GwAWAd9tBAAUanPX
                                                                                                                                                              2024-07-18 19:39:32 UTC264INHTTP/1.1 200 OK
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:32 GMT
                                                                                                                                                              Content-Type: application/json; charset=utf-8
                                                                                                                                                              Content-Length: 1543
                                                                                                                                                              Connection: close
                                                                                                                                                              Server: Kestrel
                                                                                                                                                              Cache-Control: max-age=0, private
                                                                                                                                                              Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
                                                                                                                                                              2024-07-18 19:39:32 UTC1543INData Raw: 7b 22 61 63 74 69 6f 6e 73 22 3a 5b 7b 22 24 74 79 70 65 22 3a 22 63 61 63 68 65 22 2c 22 6b 65 79 22 3a 7b 22 75 72 69 22 3a 22 61 70 70 68 69 74 2e 63 6f 6d 2f 61 70 70 2f 76 65 72 61 63 72 79 70 74 3f 73 74 79 6c 65 3d 69 66 72 61 6d 65 26 6c 69 6e 6b 3d 22 2c 22 69 6e 68 65 72 69 74 61 6e 63 65 22 3a 22 6e 6f 6e 65 22 7d 2c 22 6d 61 78 41 67 65 22 3a 31 30 30 38 30 30 30 30 30 30 30 30 2c 22 73 65 72 76 65 72 43 6f 6e 74 65 78 74 22 3a 22 31 3b 66 39 34 63 30 32 35 66 2d 37 35 32 33 2d 36 39 37 32 2d 62 36 31 33 2d 63 65 32 63 32 34 36 63 35 35 63 65 3b 55 4e 4b 4e 3a 31 30 30 3b 30 2e 30 31 22 2c 22 72 65 73 70 6f 6e 73 65 43 61 74 65 67 6f 72 79 22 3a 22 41 6c 6c 6f 77 65 64 22 2c 22 72 65 73 75 6c 74 22 3a 7b 22 24 74 79 70 65 22 3a 22 65 76 61 6c
                                                                                                                                                              Data Ascii: {"actions":[{"$type":"cache","key":{"uri":"apphit.com/app/veracrypt?style=iframe&link=","inheritance":"none"},"maxAge":100800000000,"serverContext":"1;f94c025f-7523-6972-b613-ce2c246c55ce;UNKN:100;0.01","responseCategory":"Allowed","result":{"$type":"eval


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              34192.168.2.449828172.183.192.1094433608C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:39:32 UTC714OUTPOST /api/browser/edge/data/toptraffic/3 HTTP/1.1
                                                                                                                                                              Host: data-edge.smartscreen.microsoft.com
                                                                                                                                                              Connection: keep-alive
                                                                                                                                                              Content-Length: 1101
                                                                                                                                                              Accept: application/octet-stream;application/x-patch-bsdiff;
                                                                                                                                                              Authorization: SmartScreenHash eyJhdXRoSWQiOiJjMmU0ZjljYS1lZjYwLTQyY2EtOTAyZi1mNzgwZTFmMTk2YTciLCAia2V5IjoiMDJYYmZmUGFWa1dmV2s5SU00WW1FZz09IiwgImhhc2giOiJ2L0VLYWlzcnBDTT0ifQ==
                                                                                                                                                              Content-Type: application/json; charset=utf-8
                                                                                                                                                              If-None-Match: "638004170464094982"
                                                                                                                                                              Sec-Fetch-Site: none
                                                                                                                                                              Sec-Fetch-Mode: no-cors
                                                                                                                                                              Sec-Fetch-Dest: empty
                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                                                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                                                                                              2024-07-18 19:39:32 UTC1101OUTData Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 22 74 3d 47 77 41 57 41 64 39 74 42 41 41 55 61 6e 50 58 4e 73 70 50 47 6c 43 51 4a 6d 46 67 65 2b 54 4b 36 55 38 36 57 57 55 4f 5a 67 41 41 45 4a 68 45 6a 34 5a 57 36 53 6e 48 6a 62 6e 4a 6e 77 55 51 65 53 33 67 41 4a 47 34 6e 58 71 4f 6f 6b 67 42 4c 69 74 68 57 55 34 71 75 33 63 55 4d 32 6d 5a 71 37 58 39 31 6d 50 6d 66 52 70 61 4c 6f 4e 6d 36 6f 7a 51 34 47 65 59 50 50 6f 69 49 36 42 49 58 38 37 33 66 6f 31 50 4f 54 68 6d 6a 4c 6d 66 75 70 52 68 41 79 6a 47 69 41 62 4d 6d 56 4e 31
                                                                                                                                                              Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":"t=GwAWAd9tBAAUanPXNspPGlCQJmFge+TK6U86WWUOZgAAEJhEj4ZW6SnHjbnJnwUQeS3gAJG4nXqOokgBLithWU4qu3cUM2mZq7X91mPmfRpaLoNm6ozQ4GeYPPoiI6BIX873fo1POThmjLmfupRhAyjGiAbMmVN1
                                                                                                                                                              2024-07-18 19:39:32 UTC189INHTTP/1.1 304 Not Modified
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:32 GMT
                                                                                                                                                              Content-Length: 0
                                                                                                                                                              Connection: close
                                                                                                                                                              Server: Kestrel
                                                                                                                                                              Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              35192.168.2.449827172.183.192.1094433608C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:39:32 UTC717OUTPOST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1
                                                                                                                                                              Host: data-edge.smartscreen.microsoft.com
                                                                                                                                                              Connection: keep-alive
                                                                                                                                                              Content-Length: 1101
                                                                                                                                                              Accept: application/octet-stream;application/x-patch-bsdiff;
                                                                                                                                                              Authorization: SmartScreenHash eyJhdXRoSWQiOiJjMmU0ZjljYS1lZjYwLTQyY2EtOTAyZi1mNzgwZTFmMTk2YTciLCAia2V5IjoiMDJYYmZmUGFWa1dmV2s5SU00WW1FZz09IiwgImhhc2giOiJ2L0VLYWlzcnBDTT0ifQ==
                                                                                                                                                              Content-Type: application/json; charset=utf-8
                                                                                                                                                              If-None-Match: "638343870221005468"
                                                                                                                                                              Sec-Fetch-Site: none
                                                                                                                                                              Sec-Fetch-Mode: no-cors
                                                                                                                                                              Sec-Fetch-Dest: empty
                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                                                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                                                                                              2024-07-18 19:39:32 UTC1101OUTData Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 22 74 3d 47 77 41 57 41 64 39 74 42 41 41 55 61 6e 50 58 4e 73 70 50 47 6c 43 51 4a 6d 46 67 65 2b 54 4b 36 55 38 36 57 57 55 4f 5a 67 41 41 45 4a 68 45 6a 34 5a 57 36 53 6e 48 6a 62 6e 4a 6e 77 55 51 65 53 33 67 41 4a 47 34 6e 58 71 4f 6f 6b 67 42 4c 69 74 68 57 55 34 71 75 33 63 55 4d 32 6d 5a 71 37 58 39 31 6d 50 6d 66 52 70 61 4c 6f 4e 6d 36 6f 7a 51 34 47 65 59 50 50 6f 69 49 36 42 49 58 38 37 33 66 6f 31 50 4f 54 68 6d 6a 4c 6d 66 75 70 52 68 41 79 6a 47 69 41 62 4d 6d 56 4e 31
                                                                                                                                                              Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":"t=GwAWAd9tBAAUanPXNspPGlCQJmFge+TK6U86WWUOZgAAEJhEj4ZW6SnHjbnJnwUQeS3gAJG4nXqOokgBLithWU4qu3cUM2mZq7X91mPmfRpaLoNm6ozQ4GeYPPoiI6BIX873fo1POThmjLmfupRhAyjGiAbMmVN1
                                                                                                                                                              2024-07-18 19:39:32 UTC189INHTTP/1.1 304 Not Modified
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:32 GMT
                                                                                                                                                              Content-Length: 0
                                                                                                                                                              Connection: close
                                                                                                                                                              Server: Kestrel
                                                                                                                                                              Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              36192.168.2.44983095.111.225.2114433608C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:39:33 UTC1385OUTGET /favicon.ico HTTP/1.1
                                                                                                                                                              Host: apphit.com
                                                                                                                                                              Connection: keep-alive
                                                                                                                                                              sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"
                                                                                                                                                              sec-ch-ua-mobile: ?0
                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                                                                                                                              sec-ch-ua-platform: "Windows"
                                                                                                                                                              Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                                                                                                                                                              Sec-Fetch-Site: same-origin
                                                                                                                                                              Sec-Fetch-Mode: no-cors
                                                                                                                                                              Sec-Fetch-Dest: image
                                                                                                                                                              Referer: https://apphit.com/app/veracrypt?style=iframe&link=
                                                                                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                                                                                              Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                                                                                                                              Cookie: XSRF-TOKEN=eyJpdiI6IlRDUFdYME9ZcXBrM2hyNWNrYURDTEE9PSIsInZhbHVlIjoiQ2NPTmFwdzRQemwwOEQveERmMXBiYWJURnByZWljd1hKSEV0c1VSUWllQzZvSmRmdTJya05BSDREaVlEeVYxdWMrVEVUc2tGdS9GWUI1Vi8xYnJIZ2dHbzVLM1Bma3A1WXZzVzFsaTlFWHB5YUUxVE1sSUY5d0FxSGlOTWZNOGUiLCJtYWMiOiI5YjFkYmRlNmQxYWNmY2YwOGQ5NDIwNzFiYjg2MDIyMjUzZDJlOWI0ZmZlNmNkMGU3YjJiYmVhNzhiOTZmMzRmIiwidGFnIjoiIn0%3D; apphit_session=eyJpdiI6Imc0WmF2ZDFDMjR5YTJOWG9tWG1MOGc9PSIsInZhbHVlIjoiQzc1OE00bCtvZzVUeW01ajlrVllXMkVCRDBuc1B5bFJwSHRWUUZKME5PeVYrbkpjSHByeU1Va1FlQ0lENTM2LzdiV1BnNDJnWi9IMVRwc0laaFU5KzVFWCtmNmZtNVZtT3dKMHdnT3g1Q2NUWHh0TDRUK0NPT0ZMMEdNOUhlWmsiLCJtYWMiOiI0Mzc4ZjEzZGJkMzc1ZGQwYzhmNzMwYTlkNjBhOWY4MzE2MjdhOTI2OTYwODk5OGIzZjljYWU2NjViZTE0YWJjIiwidGFnIjoiIn0%3D
                                                                                                                                                              2024-07-18 19:39:33 UTC405INHTTP/1.1 200 OK
                                                                                                                                                              Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:33 GMT
                                                                                                                                                              Content-Type: image/x-icon
                                                                                                                                                              Content-Length: 4286
                                                                                                                                                              Last-Modified: Wed, 04 Aug 2021 11:26:15 GMT
                                                                                                                                                              Connection: close
                                                                                                                                                              ETag: "610a7957-10be"
                                                                                                                                                              Expires: Thu, 25 Jul 2024 19:39:33 GMT
                                                                                                                                                              Cache-Control: max-age=604800
                                                                                                                                                              Strict-Transport-Security: max-age=15768000; preload
                                                                                                                                                              X-Content-Type-Options: nosniff
                                                                                                                                                              Accept-Ranges: bytes
                                                                                                                                                              2024-07-18 19:39:33 UTC4286INData Raw: 00 00 01 00 01 00 20 20 00 00 01 00 20 00 a8 10 00 00 16 00 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 c0 64 00 3f be 63 00 3f be 63 00 3f be 63 00 40 bf 64 03 3f be 63 2b 3f be 63 6f 3f be 63 b0 3f be 63 dc 3f be 63 f4 3f be 63 fe 3f be 63 fe 3f be 63 f4 3f be 63 dc 3f be 63 b0 3f be 63 6f 3f be 63 2b 40 c0 64 03 3f be 63 00 40 bf 64 00 3f bf 63 00 42 c3 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3f bf 63 00 3f be 63 00 3f be 63 00 40 bf 64 02 3f be 63 39 3f be 63 9a 3f be 63 e1 3f be 63 fc 3f be 63 ff 3f be 63 ff 3f be 63 ff 3f be 63 ff 3f
                                                                                                                                                              Data Ascii: ( @ @d?c?c?c@d?c+?co?c?c?c?c?c?c?c?c?co?c+@d?c@d?cBf?c?c?c@d?c9?c?c?c?c?c?c?c?


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              37192.168.2.44983195.111.225.2114433608C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:39:34 UTC1392OUTGET /images/favicon.png HTTP/1.1
                                                                                                                                                              Host: apphit.com
                                                                                                                                                              Connection: keep-alive
                                                                                                                                                              sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117", "Microsoft Edge WebView2";v="117"
                                                                                                                                                              sec-ch-ua-mobile: ?0
                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
                                                                                                                                                              sec-ch-ua-platform: "Windows"
                                                                                                                                                              Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                                                                                                                                                              Sec-Fetch-Site: same-origin
                                                                                                                                                              Sec-Fetch-Mode: no-cors
                                                                                                                                                              Sec-Fetch-Dest: image
                                                                                                                                                              Referer: https://apphit.com/app/veracrypt?style=iframe&link=
                                                                                                                                                              Accept-Encoding: gzip, deflate, br
                                                                                                                                                              Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
                                                                                                                                                              Cookie: XSRF-TOKEN=eyJpdiI6IlRDUFdYME9ZcXBrM2hyNWNrYURDTEE9PSIsInZhbHVlIjoiQ2NPTmFwdzRQemwwOEQveERmMXBiYWJURnByZWljd1hKSEV0c1VSUWllQzZvSmRmdTJya05BSDREaVlEeVYxdWMrVEVUc2tGdS9GWUI1Vi8xYnJIZ2dHbzVLM1Bma3A1WXZzVzFsaTlFWHB5YUUxVE1sSUY5d0FxSGlOTWZNOGUiLCJtYWMiOiI5YjFkYmRlNmQxYWNmY2YwOGQ5NDIwNzFiYjg2MDIyMjUzZDJlOWI0ZmZlNmNkMGU3YjJiYmVhNzhiOTZmMzRmIiwidGFnIjoiIn0%3D; apphit_session=eyJpdiI6Imc0WmF2ZDFDMjR5YTJOWG9tWG1MOGc9PSIsInZhbHVlIjoiQzc1OE00bCtvZzVUeW01ajlrVllXMkVCRDBuc1B5bFJwSHRWUUZKME5PeVYrbkpjSHByeU1Va1FlQ0lENTM2LzdiV1BnNDJnWi9IMVRwc0laaFU5KzVFWCtmNmZtNVZtT3dKMHdnT3g1Q2NUWHh0TDRUK0NPT0ZMMEdNOUhlWmsiLCJtYWMiOiI0Mzc4ZjEzZGJkMzc1ZGQwYzhmNzMwYTlkNjBhOWY4MzE2MjdhOTI2OTYwODk5OGIzZjljYWU2NjViZTE0YWJjIiwidGFnIjoiIn0%3D
                                                                                                                                                              2024-07-18 19:39:34 UTC402INHTTP/1.1 200 OK
                                                                                                                                                              Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:34 GMT
                                                                                                                                                              Content-Type: image/png
                                                                                                                                                              Content-Length: 56904
                                                                                                                                                              Last-Modified: Wed, 04 Aug 2021 11:26:15 GMT
                                                                                                                                                              Connection: close
                                                                                                                                                              ETag: "610a7957-de48"
                                                                                                                                                              Expires: Fri, 19 Jul 2024 19:39:34 GMT
                                                                                                                                                              Cache-Control: max-age=86400
                                                                                                                                                              Strict-Transport-Security: max-age=15768000; preload
                                                                                                                                                              X-Content-Type-Options: nosniff
                                                                                                                                                              Accept-Ranges: bytes
                                                                                                                                                              2024-07-18 19:39:34 UTC15982INData Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 c6 00 00 01 c6 08 06 00 00 00 ee 62 2b 29 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 22 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 33 2d 63 30 31 31 20 36 36 2e 31 34 35 36 36 31 2c 20 32 30 31 32 2f 30 32 2f 30 36 2d 31 34 3a 35 36 3a 32 37 20 20
                                                                                                                                                              Data Ascii: PNGIHDRb+)tEXtSoftwareAdobe ImageReadyqe<"iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27
                                                                                                                                                              2024-07-18 19:39:34 UTC16384INData Raw: 54 91 fc db 52 fd ea e4 71 ca 9c ea 24 7a 57 b3 16 63 10 31 5e ee 96 c9 fb 61 67 ff 3e 52 43 22 50 46 2d 83 0d 02 22 02 e3 e9 f9 e3 f0 e5 c3 9f 82 e7 ce 7c 87 58 2e 82 a2 d1 43 d3 1f 64 31 47 80 54 3d 57 71 93 70 42 b0 c7 8b ab 33 94 56 0d 55 8d 0a 63 a1 c6 3c 62 cb 6b 05 8f 87 bb c6 61 4b f7 14 15 42 c6 a4 00 78 5d 8a 12 2b c5 05 9a a0 d1 16 1c 8b bf a3 bd 15 9f ff 5c ea 02 9c 5a 3c 4a 71 95 7d ad fd a5 4c 3a 45 70 b9 b8 7a 16 4e 2d e9 72 a5 82 31 80 3f 28 75 aa 0a 8c 8b c6 eb 55 23 ff 29 2e 31 9f cb 63 28 41 f9 86 59 02 63 2d 91 b1 3d d6 14 7b 5d 3c 87 17 2a cf 95 5a 1d 30 fe 92 e8 07 6a 89 78 eb 51 b5 5a 89 3d d1 af c7 a9 4d b4 a2 33 28 72 8b 73 72 53 1e 47 07 8f 53 73 78 87 55 90 be b3 9a 95 91 ea 2b 95 4d 42 4b bc 15 2e 1b ba 1a 6e 9d bc 57 75 d7 e7
                                                                                                                                                              Data Ascii: TRq$zWc1^ag>RC"PF-"|X.Cd1GT=WqpB3VUc<bkaKBx]+\Z<Jq}L:EpzN-r1?(uU#).1c(AYc-={]<*Z0jxQZ=M3(rsrSGSsxU+MBK.nWu
                                                                                                                                                              2024-07-18 19:39:34 UTC16384INData Raw: a0 61 00 b4 59 e2 2b 02 b5 1f 95 d7 c3 c3 c9 01 b0 a4 4a 01 56 ac 8c 2a 7f 0c 59 9a 11 f5 e3 0a db 4e 39 f5 b5 06 b4 1a ad 5e f0 70 1e a5 60 cd 9e a3 86 8c d2 94 ea 98 03 d3 00 00 72 8c 52 cb 95 61 c7 d7 45 55 a0 22 1c a3 df b5 09 ae da 37 2d bd 9c 15 2b 63 0c 7a 3a 80 c2 20 e3 4b 02 c4 c8 48 13 65 aa bc 16 97 e0 28 92 8e 27 3a dd 60 3a 5b c4 02 d8 a2 5d 5f ec 5f 2a 4a 6d 59 42 bb 8e a5 83 4e c2 85 f1 1c 03 33 e8 24 13 f3 28 8d 7e e6 c7 50 20 70 6d d6 9b 24 66 a8 ce 78 a3 be 06 2d 49 c6 94 19 f5 06 50 a6 1b 06 20 36 c2 73 54 64 01 ef b6 47 1a 18 62 e2 70 03 cf f3 24 38 56 a6 ab e0 60 34 b3 56 ca ce 29 da c4 c2 dc e0 45 30 46 37 3b 6b cb 47 eb 72 b1 c7 91 63 8e f9 ef 1f 0d 3f c7 ac 6d 90 60 4e 45 83 24 02 69 f7 8f 96 39 5a 99 00 e1 11 c5 97 96 d4 1f 83 4e
                                                                                                                                                              Data Ascii: aY+JV*YN9^p`rRaEU"7-+cz: KHe(':`:[]__*JmYBN3$(~P pm$fx-IP 6sTdGbp$8V`4V)E0F7;kGrc?m`NE$i9ZN
                                                                                                                                                              2024-07-18 19:39:34 UTC8154INData Raw: 5f 93 e9 80 59 9b 63 32 8f 4d bc 36 4c 76 ca 47 2d df 0a e2 5b 72 f0 9f 51 19 2b 13 06 c8 92 bf 37 65 77 98 37 d5 59 c2 0f 30 73 6c 6b 46 b3 69 1e 96 38 60 50 14 e2 38 6c 1f 73 f0 37 86 e9 8c 59 81 e1 ca 11 62 8d 1f 24 d6 f8 1e 0b 65 a3 c1 1c 95 75 19 bb 00 c9 93 c1 54 a5 ad b9 9f 40 ba 82 e0 7a 9e 22 7d 57 b4 02 47 02 50 f2 f8 79 4c 9c 25 78 aa e2 e0 39 d9 61 be 9a 3b 08 f9 d2 fd f6 07 82 1a e5 6d a4 8b 31 5f b9 a0 24 dd 88 e9 37 94 06 86 88 26 f3 94 28 4b cc 59 07 02 55 ec 36 5b a9 aa 54 90 29 13 10 b3 82 62 9f cf 3b 2f 28 ca 75 e5 0a 13 45 27 0e 0f 53 77 0e 1b 18 85 bc 8f 1a e3 7a d2 e0 2f b0 50 36 3a e0 08 2a 80 e4 09 b1 74 a0 37 b1 32 a7 bd ce e8 36 3c 50 86 5e 85 4c a2 a8 64 93 89 ca 94 ab ef 3b 71 6c 26 64 1a 49 e4 b0 19 3d f1 38 68 12 5c 47 89 1b
                                                                                                                                                              Data Ascii: _Yc2M6LvG-[rQ+7ew7Y0slkFi8`P8ls7Yb$euT@z"}WGPyL%x9a;m1_$7&(KYU6[T)b;/(uE'Swz/P6:*t726<P^Ld;ql&dI=8h\G


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              38192.168.2.44983234.117.223.223443824C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:39:35 UTC139OUTPOST /v4/receive/json/25 HTTP/1.1
                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                              User-Agent: Icarus Http/1.0
                                                                                                                                                              Content-Length: 1363
                                                                                                                                                              Host: analytics.avcdn.net
                                                                                                                                                              2024-07-18 19:39:35 UTC1363OUTData Raw: 7b 22 72 65 63 6f 72 64 22 3a 5b 7b 22 65 76 65 6e 74 22 3a 7b 22 74 79 70 65 22 3a 32 35 2c 22 73 75 62 74 79 70 65 22 3a 31 2c 22 72 65 71 75 65 73 74 5f 69 64 22 3a 22 63 35 62 35 62 66 64 39 2d 38 65 62 37 2d 34 32 63 35 2d 38 30 35 36 2d 34 65 65 63 34 31 64 36 64 61 63 61 22 2c 22 74 69 6d 65 22 3a 31 37 32 31 33 33 38 34 33 38 32 35 31 7d 2c 22 73 65 74 75 70 22 3a 7b 22 63 6f 6d 6d 6f 6e 22 3a 7b 22 6f 70 65 72 61 74 69 6f 6e 22 3a 22 69 6e 73 74 61 6c 6c 22 2c 22 73 65 73 73 69 6f 6e 5f 69 64 22 3a 22 31 38 34 30 63 36 37 38 2d 64 36 32 61 2d 34 39 34 35 2d 38 65 34 66 2d 33 36 65 61 66 33 66 30 63 34 61 35 22 2c 22 73 74 61 67 65 22 3a 22 73 66 78 2d 72 75 6e 6e 69 6e 67 2d 69 63 61 72 75 73 22 2c 22 74 69 74 6c 65 22 3a 22 41 56 47 20 41 6e 74
                                                                                                                                                              Data Ascii: {"record":[{"event":{"type":25,"subtype":1,"request_id":"c5b5bfd9-8eb7-42c5-8056-4eec41d6daca","time":1721338438251},"setup":{"common":{"operation":"install","session_id":"1840c678-d62a-4945-8e4f-36eaf3f0c4a5","stage":"sfx-running-icarus","title":"AVG Ant
                                                                                                                                                              2024-07-18 19:39:35 UTC216INHTTP/1.1 200 OK
                                                                                                                                                              Server: nginx
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:35 GMT
                                                                                                                                                              Content-Type: application/json
                                                                                                                                                              Content-Length: 19
                                                                                                                                                              Via: 1.1 google
                                                                                                                                                              Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                                                                                              Connection: close
                                                                                                                                                              2024-07-18 19:39:35 UTC19INData Raw: 7b 22 70 72 6f 63 65 73 73 65 64 22 3a 20 74 72 75 65 7d
                                                                                                                                                              Data Ascii: {"processed": true}


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              39192.168.2.44983334.117.223.2234437884C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:39:36 UTC243OUTPOST /v4/receive/json/25 HTTP/1.1
                                                                                                                                                              Host: analytics.avcdn.net
                                                                                                                                                              User-Agent: libcurl/8.7.0-DEV Schannel zlib/1.3.1 c-ares/1.28.1 nghttp2/1.48.0
                                                                                                                                                              Accept: */*
                                                                                                                                                              Accept-Encoding: deflate, gzip
                                                                                                                                                              Content-Type: application/json
                                                                                                                                                              Content-Length: 2117
                                                                                                                                                              2024-07-18 19:39:36 UTC2117OUTData Raw: 7b 22 72 65 63 6f 72 64 22 3a 5b 7b 0a 09 22 65 76 65 6e 74 22 20 3a 20 0a 09 7b 0a 09 09 22 72 65 71 75 65 73 74 5f 69 64 22 20 3a 20 22 38 39 34 61 35 64 62 62 2d 65 35 61 63 2d 34 62 36 36 2d 38 38 31 63 2d 64 65 61 37 33 63 65 37 64 63 37 63 22 2c 0a 09 09 22 73 75 62 74 79 70 65 22 20 3a 20 31 2c 0a 09 09 22 74 69 6d 65 22 20 3a 20 31 37 32 31 33 33 38 30 32 30 39 38 33 2c 0a 09 09 22 74 79 70 65 22 20 3a 20 32 35 0a 09 7d 2c 0a 09 22 69 64 65 6e 74 69 74 79 22 20 3a 20 0a 09 7b 0a 09 09 22 65 6e 64 70 6f 69 6e 74 5f 69 64 22 20 3a 20 22 39 37 37 32 66 33 33 64 2d 62 32 62 63 2d 34 63 39 34 2d 62 35 61 39 2d 35 32 65 64 39 61 38 32 35 64 31 30 22 2c 0a 09 09 22 66 69 6e 67 65 72 70 72 69 6e 74 22 20 3a 20 22 32 34 31 39 46 31 42 33 38 34 39 36 33 33
                                                                                                                                                              Data Ascii: {"record":[{"event" : {"request_id" : "894a5dbb-e5ac-4b66-881c-dea73ce7dc7c","subtype" : 1,"time" : 1721338020983,"type" : 25},"identity" : {"endpoint_id" : "9772f33d-b2bc-4c94-b5a9-52ed9a825d10","fingerprint" : "2419F1B3849633
                                                                                                                                                              2024-07-18 19:39:37 UTC216INHTTP/1.1 200 OK
                                                                                                                                                              Server: nginx
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:36 GMT
                                                                                                                                                              Content-Type: application/json
                                                                                                                                                              Content-Length: 19
                                                                                                                                                              Via: 1.1 google
                                                                                                                                                              Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                                                                                              Connection: close
                                                                                                                                                              2024-07-18 19:39:37 UTC19INData Raw: 7b 22 70 72 6f 63 65 73 73 65 64 22 3a 20 74 72 75 65 7d
                                                                                                                                                              Data Ascii: {"processed": true}


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              40192.168.2.44983434.160.176.284437884C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:39:36 UTC425OUTGET /?p_age=0&p_bld=mmm_irs_ppi_902_451_o&p_cpua=x64&p_edi=15&p_icar=1&p_lng=en&p_midex=3F5C7CD44D1F6AC769934CADA267B4DF43CEF16EBFB411D103FDD4B0F14B185F&p_ost=0&p_osv=10.0&p_pro=111&p_prod=avg-av&p_ram=8191&p_vbd=9241&p_vep=24&p_ves=6&p_vre=1898&repoid=release& HTTP/1.1
                                                                                                                                                              Host: shepherd.avcdn.net
                                                                                                                                                              User-Agent: libcurl/8.7.0-DEV Schannel zlib/1.3.1 c-ares/1.28.1 nghttp2/1.48.0
                                                                                                                                                              Accept: */*
                                                                                                                                                              Accept-Encoding: deflate, gzip
                                                                                                                                                              2024-07-18 19:39:37 UTC586INHTTP/1.1 200 OK
                                                                                                                                                              Server: nginx
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:36 GMT
                                                                                                                                                              Content-Type: text/plain
                                                                                                                                                              Content-Length: 757
                                                                                                                                                              Access-Control-Allow-Origin: *
                                                                                                                                                              Access-Control-Expose-Headers: Config-Id, Config-Name, Config-Version, Segments, AB-Tests, TTL, TTL-Spread
                                                                                                                                                              Config-Id: 41
                                                                                                                                                              Config-Name: Icarus_ipm-messaging-in-22.11-and-higher_avg-av-release_avg-av-7bf18af74dcd19fd6a51bfa4edc69116d6a4a99efe277dab391351e8b66a23ed
                                                                                                                                                              Config-Version: 521
                                                                                                                                                              Segments: ipm messaging in 22.11 and higher,avg-av release,avg-av
                                                                                                                                                              TTL: 86400
                                                                                                                                                              TTL-Spread: 43200
                                                                                                                                                              Via: 1.1 google
                                                                                                                                                              Alt-Svc: clear
                                                                                                                                                              Connection: close
                                                                                                                                                              2024-07-18 19:39:37 UTC757INData Raw: 5b 75 69 2e 6f 66 66 65 72 2e 61 63 74 69 6f 6e 73 5d 0d 0a 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 69 70 6d 2e 61 76 63 64 6e 2e 6e 65 74 2f 0d 0a 5b 75 69 2e 6f 66 66 65 72 2e 77 65 6c 63 6f 6d 65 5d 0d 0a 6c 6f 61 64 74 69 6d 65 72 3d 31 30 30 30 30 0d 0a 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 69 70 6d 2e 61 76 63 64 6e 2e 6e 65 74 2f 0d 0a 5b 62 75 67 72 65 70 6f 72 74 5d 0d 0a 70 72 6f 64 75 63 74 5f 66 69 6e 69 73 68 65 64 5f 65 72 72 6f 72 73 3d 32 35 38 2c 34 35 30 32 31 0d 0a 5b 72 65 70 6f 72 74 69 6e 67 5d 0d 0a 64 69 73 61 62 6c 65 5f 63 68 65 63 6b 66 6f 72 75 70 64 61 74 65 73 3d 31 0d 0a 72 65 70 6f 72 74 5f 61 63 74 69 6f 6e 5f 69 64 73 3d 52 49 44 5f 30 30 31 2c 52 49 44 5f 30 30 32 0d 0a 5b 63 6f 6d 6d 6f 6e 5d 0d 0a 63 6f 6e 66 69 67 2d 64 65
                                                                                                                                                              Data Ascii: [ui.offer.actions]url=https://ipm.avcdn.net/[ui.offer.welcome]loadtimer=10000url=https://ipm.avcdn.net/[bugreport]product_finished_errors=258,45021[reporting]disable_checkforupdates=1report_action_ids=RID_001,RID_002[common]config-de


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              41192.168.2.44983634.160.176.284437884C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:39:38 UTC420OUTGET /?p_age=0&p_bld=mmm_irs_ppi_902_451_o&p_cpua=x64&p_icar=1&p_lng=en&p_midex=3F5C7CD44D1F6AC769934CADA267B4DF43CEF16EBFB411D103FDD4B0F14B185F&p_ost=0&p_osv=10.0&p_pro=111&p_prod=avg-av-vps&p_ram=8191&p_vbd=1806&p_vep=24&p_ves=7&p_vre=6883&repoid=release& HTTP/1.1
                                                                                                                                                              Host: shepherd.avcdn.net
                                                                                                                                                              User-Agent: libcurl/8.7.0-DEV Schannel zlib/1.3.1 c-ares/1.28.1 nghttp2/1.48.0
                                                                                                                                                              Accept: */*
                                                                                                                                                              Accept-Encoding: deflate, gzip
                                                                                                                                                              2024-07-18 19:39:38 UTC592INHTTP/1.1 200 OK
                                                                                                                                                              Server: nginx
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:38 GMT
                                                                                                                                                              Content-Type: text/plain
                                                                                                                                                              Content-Length: 583
                                                                                                                                                              Access-Control-Allow-Origin: *
                                                                                                                                                              Access-Control-Expose-Headers: Config-Id, Config-Name, Config-Version, Segments, AB-Tests, TTL, TTL-Spread
                                                                                                                                                              Config-Id: 41
                                                                                                                                                              Config-Name: Icarus_ipm-messaging-in-22.11-and-higher_avg-av-vps-fulldump-test-69c8e65c6e5f9e105128f26c2f66e51341ca9fbb12fb3532f7fcce91e1103d0a
                                                                                                                                                              Config-Version: 521
                                                                                                                                                              Segments: ipm messaging in 22.11 and higher,avg-av-vps fulldump test
                                                                                                                                                              TTL: 86400
                                                                                                                                                              TTL-Spread: 43200
                                                                                                                                                              Via: 1.1 google
                                                                                                                                                              Alt-Svc: clear
                                                                                                                                                              Connection: close
                                                                                                                                                              2024-07-18 19:39:38 UTC583INData Raw: 5b 75 69 2e 6f 66 66 65 72 2e 61 63 74 69 6f 6e 73 5d 0d 0a 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 69 70 6d 2e 61 76 63 64 6e 2e 6e 65 74 2f 0d 0a 5b 75 69 2e 6f 66 66 65 72 2e 77 65 6c 63 6f 6d 65 5d 0d 0a 6c 6f 61 64 74 69 6d 65 72 3d 31 30 30 30 30 0d 0a 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 69 70 6d 2e 61 76 63 64 6e 2e 6e 65 74 2f 0d 0a 5b 72 65 70 6f 72 74 69 6e 67 5d 0d 0a 64 69 73 61 62 6c 65 5f 63 68 65 63 6b 66 6f 72 75 70 64 61 74 65 73 3d 31 0d 0a 72 65 70 6f 72 74 5f 61 63 74 69 6f 6e 5f 69 64 73 3d 52 49 44 5f 30 30 31 2c 52 49 44 5f 30 30 32 0d 0a 5b 63 6f 6d 6d 6f 6e 5d 0d 0a 63 6f 6e 66 69 67 2d 64 65 66 2d 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 68 65 70 68 65 72 64 2e 61 76 63 64 6e 2e 6e 65 74 2f 0d 0a 72 65 70 6f 72 74 2d 75 72 6c 3d 68 74
                                                                                                                                                              Data Ascii: [ui.offer.actions]url=https://ipm.avcdn.net/[ui.offer.welcome]loadtimer=10000url=https://ipm.avcdn.net/[reporting]disable_checkforupdates=1report_action_ids=RID_001,RID_002[common]config-def-url=https://shepherd.avcdn.net/report-url=ht


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              42192.168.2.44986734.117.223.2234437884C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:39:52 UTC243OUTPOST /v4/receive/json/25 HTTP/1.1
                                                                                                                                                              Host: analytics.avcdn.net
                                                                                                                                                              User-Agent: libcurl/8.7.0-DEV Schannel zlib/1.3.1 c-ares/1.28.1 nghttp2/1.48.0
                                                                                                                                                              Accept: */*
                                                                                                                                                              Accept-Encoding: deflate, gzip
                                                                                                                                                              Content-Type: application/json
                                                                                                                                                              Content-Length: 3332
                                                                                                                                                              2024-07-18 19:39:52 UTC3332OUTData Raw: 7b 22 72 65 63 6f 72 64 22 3a 5b 7b 0a 09 22 65 76 65 6e 74 22 20 3a 20 0a 09 7b 0a 09 09 22 72 65 71 75 65 73 74 5f 69 64 22 20 3a 20 22 33 33 61 32 37 39 37 36 2d 37 32 31 34 2d 34 37 35 32 2d 39 39 30 33 2d 66 30 34 30 62 32 39 66 61 34 33 65 22 2c 0a 09 09 22 73 75 62 74 79 70 65 22 20 3a 20 31 2c 0a 09 09 22 74 69 6d 65 22 20 3a 20 31 37 32 31 33 33 38 30 33 37 35 32 37 2c 0a 09 09 22 74 79 70 65 22 20 3a 20 32 35 0a 09 7d 2c 0a 09 22 69 64 65 6e 74 69 74 79 22 20 3a 20 0a 09 7b 0a 09 09 22 65 6e 64 70 6f 69 6e 74 5f 69 64 22 20 3a 20 22 39 37 37 32 66 33 33 64 2d 62 32 62 63 2d 34 63 39 34 2d 62 35 61 39 2d 35 32 65 64 39 61 38 32 35 64 31 30 22 2c 0a 09 09 22 66 69 6e 67 65 72 70 72 69 6e 74 22 20 3a 20 22 32 34 31 39 46 31 42 33 38 34 39 36 33 33
                                                                                                                                                              Data Ascii: {"record":[{"event" : {"request_id" : "33a27976-7214-4752-9903-f040b29fa43e","subtype" : 1,"time" : 1721338037527,"type" : 25},"identity" : {"endpoint_id" : "9772f33d-b2bc-4c94-b5a9-52ed9a825d10","fingerprint" : "2419F1B3849633
                                                                                                                                                              2024-07-18 19:39:53 UTC216INHTTP/1.1 200 OK
                                                                                                                                                              Server: nginx
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:53 GMT
                                                                                                                                                              Content-Type: application/json
                                                                                                                                                              Content-Length: 19
                                                                                                                                                              Via: 1.1 google
                                                                                                                                                              Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                                                                                              Connection: close
                                                                                                                                                              2024-07-18 19:39:53 UTC19INData Raw: 7b 22 70 72 6f 63 65 73 73 65 64 22 3a 20 74 72 75 65 7d
                                                                                                                                                              Data Ascii: {"processed": true}


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              43192.168.2.44986934.117.223.2234437884C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:39:54 UTC243OUTPOST /v4/receive/json/25 HTTP/1.1
                                                                                                                                                              Host: analytics.avcdn.net
                                                                                                                                                              User-Agent: libcurl/8.7.0-DEV Schannel zlib/1.3.1 c-ares/1.28.1 nghttp2/1.48.0
                                                                                                                                                              Accept: */*
                                                                                                                                                              Accept-Encoding: deflate, gzip
                                                                                                                                                              Content-Type: application/json
                                                                                                                                                              Content-Length: 3926
                                                                                                                                                              2024-07-18 19:39:54 UTC3926OUTData Raw: 7b 22 72 65 63 6f 72 64 22 3a 5b 7b 0a 09 22 65 76 65 6e 74 22 20 3a 20 0a 09 7b 0a 09 09 22 72 65 71 75 65 73 74 5f 69 64 22 20 3a 20 22 34 61 65 33 30 38 66 37 2d 62 62 36 33 2d 34 39 32 38 2d 39 35 30 31 2d 35 64 33 35 64 61 37 32 34 65 37 62 22 2c 0a 09 09 22 73 75 62 74 79 70 65 22 20 3a 20 31 2c 0a 09 09 22 74 69 6d 65 22 20 3a 20 31 37 32 31 33 33 38 30 33 38 35 36 35 2c 0a 09 09 22 74 79 70 65 22 20 3a 20 32 35 0a 09 7d 2c 0a 09 22 69 64 65 6e 74 69 74 79 22 20 3a 20 0a 09 7b 0a 09 09 22 65 6e 64 70 6f 69 6e 74 5f 69 64 22 20 3a 20 22 39 37 37 32 66 33 33 64 2d 62 32 62 63 2d 34 63 39 34 2d 62 35 61 39 2d 35 32 65 64 39 61 38 32 35 64 31 30 22 2c 0a 09 09 22 66 69 6e 67 65 72 70 72 69 6e 74 22 20 3a 20 22 32 34 31 39 46 31 42 33 38 34 39 36 33 33
                                                                                                                                                              Data Ascii: {"record":[{"event" : {"request_id" : "4ae308f7-bb63-4928-9501-5d35da724e7b","subtype" : 1,"time" : 1721338038565,"type" : 25},"identity" : {"endpoint_id" : "9772f33d-b2bc-4c94-b5a9-52ed9a825d10","fingerprint" : "2419F1B3849633
                                                                                                                                                              2024-07-18 19:39:54 UTC216INHTTP/1.1 200 OK
                                                                                                                                                              Server: nginx
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:54 GMT
                                                                                                                                                              Content-Type: application/json
                                                                                                                                                              Content-Length: 19
                                                                                                                                                              Via: 1.1 google
                                                                                                                                                              Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                                                                                              Connection: close
                                                                                                                                                              2024-07-18 19:39:54 UTC19INData Raw: 7b 22 70 72 6f 63 65 73 73 65 64 22 3a 20 74 72 75 65 7d
                                                                                                                                                              Data Ascii: {"processed": true}


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                              44192.168.2.44987034.160.176.28443
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:39:54 UTC168OUTPOST / HTTP/1.1
                                                                                                                                                              Host: shepherd.avcdn.net
                                                                                                                                                              User-Agent: Avast Antivirus
                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                              Content-Length: 271
                                                                                                                                                              2024-07-18 19:39:54 UTC271OUTData Raw: 3f 70 5f 62 6c 64 3d 6d 6d 6d 5f 69 72 73 5f 70 70 69 5f 39 30 32 5f 34 35 31 5f 6f 26 70 5f 63 68 72 3d 30 26 70 5f 63 68 73 3d 35 26 70 5f 63 70 75 61 3d 78 36 34 26 70 5f 67 63 63 63 3d 30 26 70 5f 69 63 61 72 3d 31 26 70 5f 6c 6e 67 3d 65 6e 26 70 5f 6d 69 64 65 78 3d 33 46 35 43 37 43 44 34 34 44 31 46 36 41 43 37 36 39 39 33 34 43 41 44 41 32 36 37 42 34 44 46 34 33 43 45 46 31 36 45 42 46 42 34 31 31 44 31 30 33 46 44 44 34 42 30 46 31 34 42 31 38 35 46 26 70 5f 6f 73 74 3d 30 26 70 5f 6f 73 76 3d 31 30 2e 30 26 70 5f 70 72 6f 3d 37 30 26 70 5f 70 72 6f 64 3d 61 76 67 2d 61 76 26 70 5f 72 61 6d 3d 38 31 39 31 26 70 5f 73 62 69 3d 30 26 70 5f 76 62 64 3d 39 32 34 31 26 70 5f 76 65 70 3d 32 34 26 70 5f 76 65 73 3d 36 26 70 5f 76 72 65 3d 31 38 39 38
                                                                                                                                                              Data Ascii: ?p_bld=mmm_irs_ppi_902_451_o&p_chr=0&p_chs=5&p_cpua=x64&p_gccc=0&p_icar=1&p_lng=en&p_midex=3F5C7CD44D1F6AC769934CADA267B4DF43CEF16EBFB411D103FDD4B0F14B185F&p_ost=0&p_osv=10.0&p_pro=70&p_prod=avg-av&p_ram=8191&p_sbi=0&p_vbd=9241&p_vep=24&p_ves=6&p_vre=1898
                                                                                                                                                              2024-07-18 19:39:54 UTC2178INHTTP/1.1 200 OK
                                                                                                                                                              Server: nginx
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:54 GMT
                                                                                                                                                              Content-Type: text/plain
                                                                                                                                                              Content-Length: 21376
                                                                                                                                                              AB-Tests: 921ba9e1-e8ab-4473-8916-6d120da28b76:A,AV-32666-v2-fake:a,oa-7820-v1-fake-blatny:a
                                                                                                                                                              Access-Control-Allow-Origin: *
                                                                                                                                                              Access-Control-Expose-Headers: Config-Id, Config-Name, Config-Version, Segments, AB-Tests, TTL, TTL-Spread
                                                                                                                                                              Config-Id: 9
                                                                                                                                                              Config-Name: AVG-Windows-AV-Consumer_websocket-testing_email-signatures_asb-and-chrome-since-21.2_version-23.2-and-higher-not-in-fr-de_avg-free_ppi_21.10-and-newer_useipwl_release_ipm_4932_opm_pus_fullscale_previous-version_version-18.6-and-higher_windows-8-and-higher_avg-free-and-release_production_sontiq_quic-on_emailscanner-ignored-processes_ipm-bau-v23.1-and-higher_version-20.5-and-higher_useopenidwebauth_streaming-updates-globalflags_devicewatcheron_version-20.9-and-higher_pups-in-avg---rollout_winre-bts_avg-forrelease-and-beta-24.4_smartscan-free-win10-antivirus_aosstorelink_enableddwm_enablehns3_performator_avg-r24-4---r24-6_fs-and-idp-integration_cef-91_cefsettings-on_ispublicrelease_opm_burger_tracking_limitation_productversion-higher-23.2-and-country-not-in-fr-de_usa_multidetection_ipm_6515_6516_vps_sites_test_b-321a82667334597ca48493d700953f417469f140be673e049fa017b20d2af8de
                                                                                                                                                              Config-Version: 2101
                                                                                                                                                              Segments: websocket testing,email signatures,asb and chrome since 21.2,version 23.2 and higher not in fr de,avg free,ppi,21.10 and newer,useipwl_release,ipm_4932_opm_pus_fullscale,previous version,version 18.6 and higher,windows 8 and higher,avg free and release,production,sontiq,quic on,emailscanner ignored processes,ipm bau v23.1 and higher,version 20.5 and higher,useopenidwebauth,streaming updates globalflags,devicewatcheron,version 20.9 and higher,pups in avg - rollout,winre bts,avg forrelease and beta 24.4,smartscan free win10 antivirus,aosstorelink,enableddwm,enablehns3,performator,avg r24 4 - r24 6,fs and idp integration,cef 91,cefsettings on,ispublicrelease,opm_burger_tracking_limitation,productversion higher 23.2 and country not in fr de,usa,multidetection,ipm_6515_6516_vps_sites_test_b
                                                                                                                                                              TTL: 60
                                                                                                                                                              TTL-Spread: 43200
                                                                                                                                                              Via: 1.1 google
                                                                                                                                                              Alt-Svc: clear
                                                                                                                                                              Connection: close
                                                                                                                                                              2024-07-18 19:39:54 UTC1213INData Raw: 5b 52 65 6d 6f 74 65 41 63 63 65 73 73 53 68 69 65 6c 64 2e 53 65 74 74 69 6e 67 5d 0d 0a 42 72 75 74 65 46 6f 72 63 65 4d 61 78 41 74 74 65 6d 70 74 73 50 65 72 44 61 79 3d 36 30 0d 0a 42 72 75 74 65 46 6f 72 63 65 4d 61 78 41 74 74 65 6d 70 74 73 50 65 72 48 6f 75 72 3d 34 30 0d 0a 42 72 75 74 65 46 6f 72 63 65 4d 61 78 41 74 74 65 6d 70 74 73 50 65 72 4d 69 6e 75 74 65 3d 33 30 0d 0a 42 72 75 74 65 46 6f 72 63 65 4d 61 78 41 74 74 65 6d 70 74 73 50 65 72 54 65 6e 53 65 63 6f 6e 64 73 3d 31 32 0d 0a 5b 57 65 62 53 68 69 65 6c 64 2e 57 65 62 53 6f 63 6b 65 74 5d 0d 0a 45 6e 61 62 6c 65 64 3d 31 0d 0a 5b 53 65 74 74 69 6e 67 73 2e 55 73 65 72 49 6e 74 65 72 66 61 63 65 5d 0d 0a 53 68 65 6c 6c 45 78 74 65 6e 73 69 6f 6e 46 69 6c 65 4e 61 6d 65 3d 30 0d 0a
                                                                                                                                                              Data Ascii: [RemoteAccessShield.Setting]BruteForceMaxAttemptsPerDay=60BruteForceMaxAttemptsPerHour=40BruteForceMaxAttemptsPerMinute=30BruteForceMaxAttemptsPerTenSeconds=12[WebShield.WebSocket]Enabled=1[Settings.UserInterface]ShellExtensionFileName=0
                                                                                                                                                              2024-07-18 19:39:54 UTC1390INData Raw: 49 6a 70 37 49 6c 5a 6c 63 6e 4e 70 62 32 34 69 4f 69 49 78 49 69 77 69 51 32 46 74 63 47 46 70 5a 32 35 7a 49 6a 70 62 58 53 77 69 54 57 56 7a 63 32 46 6e 61 57 35 6e 49 6a 70 62 58 58 31 39 0d 0a 44 69 73 61 62 6c 65 49 70 6d 45 6c 65 6d 65 6e 74 73 3d 33 31 38 2c 31 39 36 0d 0a 5b 44 57 4d 5d 0d 0a 73 65 72 76 65 72 3d 68 74 74 70 73 3a 2f 2f 69 64 65 6e 74 69 74 79 70 72 6f 74 65 63 74 69 6f 6e 2e 61 76 67 2e 63 6f 6d 0d 0a 5b 45 78 74 65 6e 73 69 6f 6e 73 5d 0d 0a 46 46 41 4f 53 3d 77 72 63 40 61 76 61 73 74 2e 63 6f 6d 0d 0a 46 46 41 53 47 3d 61 76 67 40 73 61 66 65 67 75 61 72 64 0d 0a 46 46 41 53 50 3d 38 38 36 41 36 34 38 36 2d 33 37 42 33 2d 34 42 43 44 2d 38 39 31 42 2d 46 44 30 45 33 32 35 45 37 62 31 41 0d 0a 46 46 41 53 54 3d 61 76 67 40 73
                                                                                                                                                              Data Ascii: Ijp7IlZlcnNpb24iOiIxIiwiQ2FtcGFpZ25zIjpbXSwiTWVzc2FnaW5nIjpbXX19DisableIpmElements=318,196[DWM]server=https://identityprotection.avg.com[Extensions]FFAOS=wrc@avast.comFFASG=avg@safeguardFFASP=886A6486-37B3-4BCD-891B-FD0E325E7b1AFFAST=avg@s
                                                                                                                                                              2024-07-18 19:39:54 UTC1390INData Raw: 5f 45 6e 61 62 6c 65 64 3d 31 0d 0a 47 61 6d 65 52 75 6c 65 5f 4d 65 61 73 75 72 65 50 65 72 66 6f 72 6d 61 6e 63 65 5f 45 6e 61 62 6c 65 64 3d 30 0d 0a 47 61 6d 65 52 75 6c 65 5f 4e 6f 41 76 61 73 74 49 6e 74 65 72 72 75 70 74 69 6f 6e 73 5f 45 6e 61 62 6c 65 64 3d 31 0d 0a 47 61 6d 65 52 75 6c 65 5f 50 61 75 73 65 41 6c 6c 55 70 64 61 74 65 54 61 73 6b 73 5f 45 6e 61 62 6c 65 64 3d 31 0d 0a 47 61 6d 65 52 75 6c 65 5f 50 61 75 73 65 41 76 42 61 63 6b 67 72 6f 75 6e 64 54 61 73 6b 73 5f 45 6e 61 62 6c 65 64 3d 31 0d 0a 47 61 6d 65 52 75 6c 65 5f 50 61 75 73 65 53 79 73 74 65 6d 42 61 63 6b 67 72 6f 75 6e 64 54 61 73 6b 73 5f 45 6e 61 62 6c 65 64 3d 31 0d 0a 47 61 6d 65 52 75 6c 65 5f 50 61 75 73 65 57 69 6e 64 6f 77 73 55 70 64 61 74 65 5f 45 6e 61 62 6c
                                                                                                                                                              Data Ascii: _Enabled=1GameRule_MeasurePerformance_Enabled=0GameRule_NoAvastInterruptions_Enabled=1GameRule_PauseAllUpdateTasks_Enabled=1GameRule_PauseAvBackgroundTasks_Enabled=1GameRule_PauseSystemBackgroundTasks_Enabled=1GameRule_PauseWindowsUpdate_Enabl
                                                                                                                                                              2024-07-18 19:39:54 UTC1316INData Raw: 4e 45 58 54 5f 4e 43 43 5f 43 45 52 54 5f 30 5f 53 48 41 31 3d 35 34 39 36 46 43 32 31 45 34 35 46 35 32 42 42 43 36 44 46 46 44 36 43 33 45 35 42 30 33 44 39 46 42 32 44 32 43 42 31 0d 0a 4e 45 58 54 5f 4e 43 43 5f 43 45 52 54 5f 30 5f 56 41 4c 49 44 5f 46 52 4f 4d 3d 32 30 32 34 2d 30 31 2d 31 38 20 30 30 3a 30 30 3a 30 30 0d 0a 4e 45 58 54 5f 4e 43 43 5f 43 45 52 54 5f 30 5f 56 41 4c 49 44 5f 55 4e 54 49 4c 3d 32 30 32 35 2d 30 31 2d 31 37 20 32 33 3a 35 39 3a 35 39 0d 0a 4e 45 58 54 5f 4e 43 43 5f 43 45 52 54 5f 31 5f 53 48 41 31 3d 31 43 35 38 41 33 41 38 35 31 38 45 38 37 35 39 42 46 30 37 35 42 37 36 42 37 35 30 44 34 46 32 44 46 32 36 34 46 43 44 0d 0a 4e 45 58 54 5f 4e 43 43 5f 43 45 52 54 5f 31 5f 56 41 4c 49 44 5f 46 52 4f 4d 3d 32 30 32 31 2d
                                                                                                                                                              Data Ascii: NEXT_NCC_CERT_0_SHA1=5496FC21E45F52BBC6DFFD6C3E5B03D9FB2D2CB1NEXT_NCC_CERT_0_VALID_FROM=2024-01-18 00:00:00NEXT_NCC_CERT_0_VALID_UNTIL=2025-01-17 23:59:59NEXT_NCC_CERT_1_SHA1=1C58A3A8518E8759BF075B76B750D4F2DF264FCDNEXT_NCC_CERT_1_VALID_FROM=2021-
                                                                                                                                                              2024-07-18 19:39:54 UTC1390INData Raw: 69 72 65 2c 61 61 76 5f 65 78 70 69 72 61 74 69 6f 6e 64 61 74 65 2c 61 61 76 5f 69 6e 73 74 61 6c 6c 64 61 74 65 2c 61 61 76 5f 6c 69 63 73 74 61 74 65 2c 61 61 76 5f 70 72 6f 64 75 63 74 74 79 70 65 2c 61 61 76 5f 73 69 64 2c 61 61 76 5f 76 65 72 2c 63 6f 64 65 2c 70 5f 61 66 72 2c 70 5f 61 70 75 2c 70 5f 61 73 64 2c 70 5f 61 73 72 2c 70 5f 61 66 66 2c 70 5f 61 6d 73 67 75 69 64 2c 70 5f 61 66 70 73 2c 70 5f 61 74 61 63 61 67 65 2c 70 5f 61 74 62 6e 2c 70 5f 61 74 75 69 2c 70 5f 61 76 73 74 2c 70 5f 61 76 75 74 73 2c 70 5f 74 6f 61 2c 70 5f 61 62 6d 2c 70 5f 61 66 69 2c 70 5f 61 74 6d 2c 70 5f 61 61 65 2c 70 5f 61 76 67 75 70 2c 70 5f 61 76 72 73 74 2c 70 5f 72 75 6e 76 2c 70 5f 62 73 61 63 61 67 65 2c 70 5f 62 73 6c 69 63 2c 70 5f 62 73 6c 6d 2c 70 5f
                                                                                                                                                              Data Ascii: ire,aav_expirationdate,aav_installdate,aav_licstate,aav_producttype,aav_sid,aav_ver,code,p_afr,p_apu,p_asd,p_asr,p_aff,p_amsguid,p_afps,p_atacage,p_atbn,p_atui,p_avst,p_avuts,p_toa,p_abm,p_afi,p_atm,p_aae,p_avgup,p_avrst,p_runv,p_bsacage,p_bslic,p_bslm,p_
                                                                                                                                                              2024-07-18 19:39:54 UTC1390INData Raw: 67 65 2c 70 5f 70 63 74 6e 2c 70 5f 70 61 6c 74 2c 70 5f 70 63 74 2c 70 5f 70 76 73 77 2c 70 5f 63 70 76 2c 70 66 69 64 2c 70 5f 70 72 73 2c 70 5f 70 72 76 2c 71 5f 70 72 6f 63 65 73 73 2c 71 5f 72 65 69 6e 73 74 61 6c 6c 2c 71 5f 75 6e 69 6e 73 74 61 6c 6c 2c 71 5f 75 73 61 67 65 6c 65 6e 67 68 74 2c 70 5f 71 63 6d 2c 72 65 66 72 65 73 68 2c 75 2c 70 5f 67 69 64 2c 72 63 69 64 2c 70 5f 73 7a 62 70 69 64 2c 70 5f 73 7a 76 66 2c 70 5f 73 7a 76 74 2c 70 5f 66 73 6d 74 2c 70 5f 66 73 62 2c 70 5f 6d 73 62 2c 70 5f 73 77 62 2c 70 5f 64 70 69 2c 70 5f 72 65 68 2c 70 5f 72 65 77 2c 73 61 70 69 6b 65 79 2c 70 5f 73 6c 61 63 61 67 65 2c 70 5f 73 6c 63 63 73 2c 70 5f 73 6c 63 63 74 2c 70 5f 73 6c 64 74 74 2c 70 5f 73 6c 73 2c 70 5f 73 6c 63 74 2c 70 5f 73 6c 63 74
                                                                                                                                                              Data Ascii: ge,p_pctn,p_palt,p_pct,p_pvsw,p_cpv,pfid,p_prs,p_prv,q_process,q_reinstall,q_uninstall,q_usagelenght,p_qcm,refresh,u,p_gid,rcid,p_szbpid,p_szvf,p_szvt,p_fsmt,p_fsb,p_msb,p_swb,p_dpi,p_reh,p_rew,sapikey,p_slacage,p_slccs,p_slcct,p_sldtt,p_sls,p_slct,p_slct
                                                                                                                                                              2024-07-18 19:39:54 UTC1390INData Raw: 65 63 6f 6d 6d 2e 65 78 65 2c 57 57 41 48 6f 73 74 2e 65 78 65 2c 61 66 77 73 65 72 76 2e 65 78 65 2c 41 76 61 73 74 45 6d 55 70 64 61 74 65 2e 2c 63 6f 72 65 2e 65 78 65 2c 61 76 67 65 6d 63 2e 65 78 65 2c 6d 73 6e 6d 73 67 72 2e 65 78 65 2c 41 63 72 6f 52 64 33 32 2e 65 78 65 2c 41 63 72 6f 62 61 74 2e 65 78 65 2c 51 76 6f 64 54 65 72 6d 69 6e 61 6c 2e 65 2c 42 61 63 6b 75 70 53 65 72 76 69 63 65 2e 2c 56 69 72 74 75 61 6c 42 6f 78 2e 65 78 65 2c 76 6d 6e 61 74 2e 65 78 65 0d 0a 4d 61 78 43 6f 6e 6e 65 63 74 69 6f 6e 73 3d 31 30 30 0d 0a 5b 4e 6f 74 69 66 79 4c 69 6d 69 74 5d 0d 0a 73 65 74 74 69 6e 67 5f 62 61 73 65 3d 65 79 4a 32 5a 58 4a 7a 61 57 39 75 49 6a 6f 7a 4c 43 4a 6c 62 47 56 74 5a 57 35 30 63 79 49 36 57 33 73 69 61 57 51 69 4f 69 4a 6c 65
                                                                                                                                                              Data Ascii: ecomm.exe,WWAHost.exe,afwserv.exe,AvastEmUpdate.,core.exe,avgemc.exe,msnmsgr.exe,AcroRd32.exe,Acrobat.exe,QvodTerminal.e,BackupService.,VirtualBox.exe,vmnat.exeMaxConnections=100[NotifyLimit]setting_base=eyJ2ZXJzaW9uIjozLCJlbGVtZW50cyI6W3siaWQiOiJle
                                                                                                                                                              2024-07-18 19:39:54 UTC1390INData Raw: 33 3b 77 6d 61 3b 6f 67 67 3b 77 61 76 3b 72 73 77 63 61 74 5f 64 61 74 61 62 61 73 65 3b 73 71 6c 69 74 65 3b 73 71 6c 69 74 65 33 3b 72 73 77 63 61 74 5f 64 69 73 63 3b 69 73 6f 3b 69 6d 67 3b 6e 72 67 3b 74 63 3b 6f 64 62 3b 72 73 77 63 61 74 5f 64 6f 63 75 6d 65 6e 74 3b 64 6f 63 3b 64 6f 63 78 3b 6f 64 74 3b 72 74 66 3b 77 70 64 3b 77 70 73 3b 63 73 76 3b 6b 65 79 3b 70 64 66 3b 70 70 73 3b 70 70 74 3b 70 70 74 6d 3b 70 70 74 78 3b 70 73 3b 70 73 64 3b 76 63 66 3b 78 6c 72 3b 78 6c 73 3b 78 6c 73 6d 3b 78 6c 73 78 3b 6f 64 73 3b 6f 64 70 3b 69 6e 64 64 3b 64 78 66 3b 6b 6d 6c 3b 6b 6d 7a 3b 67 70 78 3b 63 61 64 3b 64 77 67 3b 77 6d 66 3b 74 78 74 3b 72 73 77 63 61 74 5f 70 68 6f 74 6f 3b 33 66 72 3b 61 72 69 3b 61 72 77 3b 62 61 79 3b 62 6d 70 3b 63
                                                                                                                                                              Data Ascii: 3;wma;ogg;wav;rswcat_database;sqlite;sqlite3;rswcat_disc;iso;img;nrg;tc;odb;rswcat_document;doc;docx;odt;rtf;wpd;wps;csv;key;pdf;pps;ppt;pptm;pptx;ps;psd;vcf;xlr;xls;xlsm;xlsx;ods;odp;indd;dxf;kml;kmz;gpx;cad;dwg;wmf;txt;rswcat_photo;3fr;ari;arw;bay;bmp;c
                                                                                                                                                              2024-07-18 19:39:54 UTC395INData Raw: 73 65 74 75 70 2e 65 78 65 0d 0a 61 74 72 6b 5f 70 61 72 61 6d 73 3d 5b 22 2f 53 22 2c 22 2f 73 69 6c 65 6e 74 22 5d 0d 0a 61 74 72 6b 5f 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 68 6f 6e 7a 69 6b 2e 61 76 63 64 6e 2e 6e 65 74 2f 73 65 74 75 70 2f 61 76 67 2d 61 74 72 6b 2f 72 65 6c 65 61 73 65 2f 61 76 67 5f 61 6e 74 69 74 72 61 63 6b 5f 6f 6e 6c 69 6e 65 5f 73 65 74 75 70 2e 65 78 65 0d 0a 62 67 5f 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 68 6f 6e 7a 69 6b 2e 61 76 63 64 6e 2e 6e 65 74 2f 73 65 74 75 70 2f 61 76 67 2d 62 67 2f 72 65 6c 65 61 73 65 2f 61 76 67 5f 62 72 65 61 63 68 5f 67 75 61 72 64 5f 6f 6e 6c 69 6e 65 5f 73 65 74 75 70 2e 65 78 65 0d 0a 62 73 5f 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 68 6f 6e 7a 69 6b 2e 61 76 63 64 6e 2e 6e 65 74 2f 73 65 74 75 70
                                                                                                                                                              Data Ascii: setup.exeatrk_params=["/S","/silent"]atrk_url=https://honzik.avcdn.net/setup/avg-atrk/release/avg_antitrack_online_setup.exebg_url=https://honzik.avcdn.net/setup/avg-bg/release/avg_breach_guard_online_setup.exebs_url=https://honzik.avcdn.net/setup


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              45192.168.2.44987952.25.171.1874436316C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:39:56 UTC232OUTPUT /mosaic/2.0/product-web/am/v1/record HTTP/1.1
                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                              Content-Type: application/json
                                                                                                                                                              User-Agent: SA
                                                                                                                                                              X-Api-Key: wtuQtD4DdA8poRbq0pzMh1iysE9YiVlC14kJF9ZI
                                                                                                                                                              Content-Length: 501
                                                                                                                                                              Host: analytics.apis.mcafee.com
                                                                                                                                                              2024-07-18 19:39:56 UTC501OUTData Raw: 7b 22 44 61 74 61 22 3a 7b 22 41 66 66 69 64 22 3a 22 39 31 30 38 38 22 2c 22 43 6f 75 6e 74 72 79 5f 43 6f 64 65 22 3a 22 55 53 22 2c 22 44 69 73 74 72 69 62 75 74 69 6f 6e 5f 53 75 62 49 44 22 3a 22 55 4e 44 45 46 49 4e 45 44 22 2c 22 49 6e 73 74 61 6c 6c 5f 49 44 22 3a 22 55 4e 44 45 46 49 4e 45 44 22 2c 22 49 6e 73 74 61 6c 6c 5f 4c 6f 75 64 6e 65 73 73 22 3a 22 53 69 6c 65 6e 74 22 2c 22 49 6e 73 74 61 6c 6c 5f 53 6f 75 72 63 65 22 3a 22 50 61 69 64 44 69 73 74 72 69 62 75 74 69 6f 6e 22 2c 22 49 72 6f 6e 73 6f 75 72 63 65 5f 50 69 78 65 6c 22 3a 22 55 4e 44 45 46 49 4e 45 44 22 2c 22 4d 61 63 68 69 6e 65 5f 49 44 22 3a 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 22 2c 22 4f 53 22 3a
                                                                                                                                                              Data Ascii: {"Data":{"Affid":"91088","Country_Code":"US","Distribution_SubID":"UNDEFINED","Install_ID":"UNDEFINED","Install_Loudness":"Silent","Install_Source":"PaidDistribution","Ironsource_Pixel":"UNDEFINED","Machine_ID":"9e146be9-c76a-4720-bcdb-53011b87bd06","OS":
                                                                                                                                                              2024-07-18 19:39:56 UTC303INHTTP/1.1 200 OK
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:56 GMT
                                                                                                                                                              Content-Type: application/x-amz-json-1.1
                                                                                                                                                              Content-Length: 16
                                                                                                                                                              Connection: close
                                                                                                                                                              x-amzn-RequestId: fbf29911-43bd-b8ea-a4e1-e8ddb1ab8c79
                                                                                                                                                              x-amz-id-2: 2G+Vf/OAOYfpYZPTQTTpxdZXgCkrcWXDGhtQDUGNH5BRJ835GFfzfPuqMAaKM5wi3yVbeQW638CZPSHkm7Y0ntt0LYJFrzC7
                                                                                                                                                              2024-07-18 19:39:56 UTC16INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 22 6f 6b 22 7d
                                                                                                                                                              Data Ascii: {"message":"ok"}


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              46192.168.2.44988452.25.171.1874436316C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:39:58 UTC232OUTPUT /mosaic/2.0/product-web/am/v1/record HTTP/1.1
                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                              Content-Type: application/json
                                                                                                                                                              User-Agent: SA
                                                                                                                                                              X-Api-Key: wtuQtD4DdA8poRbq0pzMh1iysE9YiVlC14kJF9ZI
                                                                                                                                                              Content-Length: 595
                                                                                                                                                              Host: analytics.apis.mcafee.com
                                                                                                                                                              2024-07-18 19:39:58 UTC595OUTData Raw: 7b 22 44 61 74 61 22 3a 7b 22 41 66 66 69 64 22 3a 22 39 31 30 38 38 22 2c 22 43 6f 75 6e 74 72 79 5f 43 6f 64 65 22 3a 22 55 53 22 2c 22 44 69 73 74 72 69 62 75 74 69 6f 6e 5f 53 75 62 49 44 22 3a 22 55 4e 44 45 46 49 4e 45 44 22 2c 22 49 6e 73 74 61 6c 6c 5f 49 44 22 3a 22 55 4e 44 45 46 49 4e 45 44 22 2c 22 49 6e 73 74 61 6c 6c 5f 4c 6f 75 64 6e 65 73 73 22 3a 22 53 69 6c 65 6e 74 22 2c 22 49 6e 73 74 61 6c 6c 5f 53 6f 75 72 63 65 22 3a 22 50 61 69 64 44 69 73 74 72 69 62 75 74 69 6f 6e 22 2c 22 49 72 6f 6e 73 6f 75 72 63 65 5f 50 69 78 65 6c 22 3a 22 55 4e 44 45 46 49 4e 45 44 22 2c 22 4d 61 63 68 69 6e 65 5f 49 44 22 3a 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 22 2c 22 4f 53 22 3a
                                                                                                                                                              Data Ascii: {"Data":{"Affid":"91088","Country_Code":"US","Distribution_SubID":"UNDEFINED","Install_ID":"UNDEFINED","Install_Loudness":"Silent","Install_Source":"PaidDistribution","Ironsource_Pixel":"UNDEFINED","Machine_ID":"9e146be9-c76a-4720-bcdb-53011b87bd06","OS":
                                                                                                                                                              2024-07-18 19:39:58 UTC303INHTTP/1.1 200 OK
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:58 GMT
                                                                                                                                                              Content-Type: application/x-amz-json-1.1
                                                                                                                                                              Content-Length: 16
                                                                                                                                                              Connection: close
                                                                                                                                                              x-amz-id-2: Log5hp2MauJbp6gPLJjraCL5PtPTlzqt/JaiHKrlotTjt9gfOiFnwbljzL2Pw420buf8RLYKYFI5AW9ryYvaqAqhY1pIx0T+
                                                                                                                                                              x-amzn-RequestId: d90cdfa6-6ce6-d6d2-861f-ae684f94dbb8
                                                                                                                                                              2024-07-18 19:39:58 UTC16INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 22 6f 6b 22 7d
                                                                                                                                                              Data Ascii: {"message":"ok"}


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              47192.168.2.44988552.25.171.1874436316C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:39:59 UTC232OUTPUT /mosaic/2.0/product-web/am/v1/record HTTP/1.1
                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                              Content-Type: application/json
                                                                                                                                                              User-Agent: SA
                                                                                                                                                              X-Api-Key: wtuQtD4DdA8poRbq0pzMh1iysE9YiVlC14kJF9ZI
                                                                                                                                                              Content-Length: 505
                                                                                                                                                              Host: analytics.apis.mcafee.com
                                                                                                                                                              2024-07-18 19:39:59 UTC505OUTData Raw: 7b 22 44 61 74 61 22 3a 7b 22 41 66 66 69 64 22 3a 22 39 31 30 38 38 22 2c 22 43 6f 75 6e 74 72 79 5f 43 6f 64 65 22 3a 22 55 53 22 2c 22 44 69 73 74 72 69 62 75 74 69 6f 6e 5f 53 75 62 49 44 22 3a 22 55 4e 44 45 46 49 4e 45 44 22 2c 22 49 6e 73 74 61 6c 6c 5f 49 44 22 3a 22 55 4e 44 45 46 49 4e 45 44 22 2c 22 49 6e 73 74 61 6c 6c 5f 4c 6f 75 64 6e 65 73 73 22 3a 22 53 69 6c 65 6e 74 22 2c 22 49 6e 73 74 61 6c 6c 5f 53 6f 75 72 63 65 22 3a 22 50 61 69 64 44 69 73 74 72 69 62 75 74 69 6f 6e 22 2c 22 49 72 6f 6e 73 6f 75 72 63 65 5f 50 69 78 65 6c 22 3a 22 55 4e 44 45 46 49 4e 45 44 22 2c 22 4d 61 63 68 69 6e 65 5f 49 44 22 3a 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 22 2c 22 4f 53 22 3a
                                                                                                                                                              Data Ascii: {"Data":{"Affid":"91088","Country_Code":"US","Distribution_SubID":"UNDEFINED","Install_ID":"UNDEFINED","Install_Loudness":"Silent","Install_Source":"PaidDistribution","Ironsource_Pixel":"UNDEFINED","Machine_ID":"9e146be9-c76a-4720-bcdb-53011b87bd06","OS":
                                                                                                                                                              2024-07-18 19:39:59 UTC315INHTTP/1.1 200 OK
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:39:59 GMT
                                                                                                                                                              Content-Type: application/x-amz-json-1.1
                                                                                                                                                              Content-Length: 16
                                                                                                                                                              Connection: close
                                                                                                                                                              x-amzn-RequestId: c88ae6b4-1d17-444f-9799-977b27141148
                                                                                                                                                              x-amz-id-2: MP1SC7ANoDji3ekIo/3CT8dujATvkbp38eCeEcIXB4JoS/+cPduJtrKBS9j7LrlH/IuYioDqw8f3byWpZU0N+ye4oHkGXJljhvrGANilW6I=
                                                                                                                                                              2024-07-18 19:39:59 UTC16INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 22 6f 6b 22 7d
                                                                                                                                                              Data Ascii: {"message":"ok"}


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                              48192.168.2.44988652.25.171.1874436316C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exe
                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                              2024-07-18 19:40:00 UTC232OUTPUT /mosaic/2.0/product-web/am/v1/record HTTP/1.1
                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                              Content-Type: application/json
                                                                                                                                                              User-Agent: SA
                                                                                                                                                              X-Api-Key: wtuQtD4DdA8poRbq0pzMh1iysE9YiVlC14kJF9ZI
                                                                                                                                                              Content-Length: 507
                                                                                                                                                              Host: analytics.apis.mcafee.com
                                                                                                                                                              2024-07-18 19:40:00 UTC507OUTData Raw: 7b 22 44 61 74 61 22 3a 7b 22 41 66 66 69 64 22 3a 22 39 31 30 38 38 22 2c 22 43 6f 75 6e 74 72 79 5f 43 6f 64 65 22 3a 22 55 53 22 2c 22 44 69 73 74 72 69 62 75 74 69 6f 6e 5f 53 75 62 49 44 22 3a 22 55 4e 44 45 46 49 4e 45 44 22 2c 22 49 6e 73 74 61 6c 6c 5f 49 44 22 3a 22 55 4e 44 45 46 49 4e 45 44 22 2c 22 49 6e 73 74 61 6c 6c 5f 4c 6f 75 64 6e 65 73 73 22 3a 22 53 69 6c 65 6e 74 22 2c 22 49 6e 73 74 61 6c 6c 5f 53 6f 75 72 63 65 22 3a 22 50 61 69 64 44 69 73 74 72 69 62 75 74 69 6f 6e 22 2c 22 49 72 6f 6e 73 6f 75 72 63 65 5f 50 69 78 65 6c 22 3a 22 55 4e 44 45 46 49 4e 45 44 22 2c 22 4d 61 63 68 69 6e 65 5f 49 44 22 3a 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 22 2c 22 4f 53 22 3a
                                                                                                                                                              Data Ascii: {"Data":{"Affid":"91088","Country_Code":"US","Distribution_SubID":"UNDEFINED","Install_ID":"UNDEFINED","Install_Loudness":"Silent","Install_Source":"PaidDistribution","Ironsource_Pixel":"UNDEFINED","Machine_ID":"9e146be9-c76a-4720-bcdb-53011b87bd06","OS":
                                                                                                                                                              2024-07-18 19:40:00 UTC303INHTTP/1.1 200 OK
                                                                                                                                                              Date: Thu, 18 Jul 2024 19:40:00 GMT
                                                                                                                                                              Content-Type: application/x-amz-json-1.1
                                                                                                                                                              Content-Length: 16
                                                                                                                                                              Connection: close
                                                                                                                                                              x-amz-id-2: ZhN7c+BDRxParu9ZTi/Jlqk+jNzV8awKXLo3eu5q/UZQJIBEYHuI0aZtneLvFqv7qKfjprpRPXk6sb6RJartm2H5+cHjVsRs
                                                                                                                                                              x-amzn-RequestId: fb1f0559-3bd1-ca39-a40c-748980380344
                                                                                                                                                              2024-07-18 19:40:00 UTC16INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 22 6f 6b 22 7d
                                                                                                                                                              Data Ascii: {"message":"ok"}


                                                                                                                                                              Statistics

                                                                                                                                                              CPU Usage

                                                                                                                                                              Click to jump to process

                                                                                                                                                              Memory Usage

                                                                                                                                                              Click to jump to process

                                                                                                                                                              High Level Behavior Distribution

                                                                                                                                                              Click to dive into process behavior distribution

                                                                                                                                                              Behavior

                                                                                                                                                              Click to jump to process

                                                                                                                                                              System Behavior

                                                                                                                                                              General

                                                                                                                                                              Target ID:0
                                                                                                                                                              Start time:15:38:00
                                                                                                                                                              Start date:18/07/2024
                                                                                                                                                              Path:C:\Users\user\Desktop\SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:"C:\Users\user\Desktop\SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe"
                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                              File size:2'576'200 bytes
                                                                                                                                                              MD5 hash:3CB0739401D24B6BC0C65E337E15C104
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:Borland Delphi
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:1
                                                                                                                                                              Start time:15:38:00
                                                                                                                                                              Start date:18/07/2024
                                                                                                                                                              Path:C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:"C:\Users\user\AppData\Local\Temp\is-0RAUV.tmp\SecuriteInfo.com.Riskware.OfferCore.5002.4698.tmp" /SL5="$10418,1635575,878080,C:\Users\user\Desktop\SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe"
                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                              File size:3'111'424 bytes
                                                                                                                                                              MD5 hash:DD40149397C65DB7E46877143552AAC5
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:Borland Delphi
                                                                                                                                                              Yara matches:
                                                                                                                                                              • Rule: JoeSecurity_QueryWinSATClassID, Description: Yara detected QueryWinSAT ClassID, Source: 00000001.00000003.2291295416.0000000000884000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              Antivirus matches:
                                                                                                                                                              • Detection: 0%, ReversingLabs
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:5
                                                                                                                                                              Start time:15:38:45
                                                                                                                                                              Start date:18/07/2024
                                                                                                                                                              Path:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:"C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe" /S
                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                              File size:27'549'456 bytes
                                                                                                                                                              MD5 hash:4F45F9BD3CC4739BDC91A4D183C0DC01
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Yara matches:
                                                                                                                                                              • Rule: JoeSecurity_PrivateLoader, Description: Yara detected PrivateLoader, Source: 00000005.00000002.2249442158.0000000002794000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:6
                                                                                                                                                              Start time:15:38:47
                                                                                                                                                              Start date:18/07/2024
                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                                                                              Imagebase:0x7ff6eef20000
                                                                                                                                                              File size:55'320 bytes
                                                                                                                                                              MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:high
                                                                                                                                                              Has exited:false

                                                                                                                                                              General

                                                                                                                                                              Target ID:7
                                                                                                                                                              Start time:15:38:52
                                                                                                                                                              Start date:18/07/2024
                                                                                                                                                              Path:C:\Program Files\BitComet\tools\BitCometService.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:"C:\Program Files\BitComet\tools\BitCometService.exe" /reg
                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                              File size:2'682'920 bytes
                                                                                                                                                              MD5 hash:AE7FBFF183FF30913EBEB38913E8CFAD
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Yara matches:
                                                                                                                                                              • Rule: JoeSecurity_PrivateLoader, Description: Yara detected PrivateLoader, Source: 00000007.00000000.2218766402.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_PrivateLoader, Description: Yara detected PrivateLoader, Source: 00000007.00000002.2219985855.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_PrivateLoader, Description: Yara detected PrivateLoader, Source: C:\Program Files\BitComet\tools\BitCometService.exe, Author: Joe Security
                                                                                                                                                              Antivirus matches:
                                                                                                                                                              • Detection: 0%, ReversingLabs
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:8
                                                                                                                                                              Start time:15:38:53
                                                                                                                                                              Start date:18/07/2024
                                                                                                                                                              Path:C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:"C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe" https://www.bitcomet.com/client/install-stats/?l=en_us&file=BitComet_2.08a_setup.exe&p=x64
                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                              File size:83'256 bytes
                                                                                                                                                              MD5 hash:EDB96675541D0275C42096B64D794D3B
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Antivirus matches:
                                                                                                                                                              • Detection: 0%, ReversingLabs
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:10
                                                                                                                                                              Start time:15:39:05
                                                                                                                                                              Start date:18/07/2024
                                                                                                                                                              Path:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:"C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exe" /affid 91088 PaidDistribution=true CountryCode=US
                                                                                                                                                              Imagebase:0x610000
                                                                                                                                                              File size:1'184'128 bytes
                                                                                                                                                              MD5 hash:143255618462A577DE27286A272584E1
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Antivirus matches:
                                                                                                                                                              • Detection: 0%, ReversingLabs
                                                                                                                                                              Reputation:moderate
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:11
                                                                                                                                                              Start time:15:39:07
                                                                                                                                                              Start date:18/07/2024
                                                                                                                                                              Path:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:"C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod1_extract\avg_antivirus_free_setup.exe" /silent /ws /psh:92pTu5fbOaMVqHXWzRazGwcsjZOgyQNZV0BXrS1y4TWZ27PXSitlzA5vE30PraTCAoRM4emN7pEfhI
                                                                                                                                                              Imagebase:0xa0000
                                                                                                                                                              File size:234'936 bytes
                                                                                                                                                              MD5 hash:26816AF65F2A3F1C61FB44C682510C97
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Antivirus matches:
                                                                                                                                                              • Detection: 0%, ReversingLabs
                                                                                                                                                              Reputation:moderate
                                                                                                                                                              Has exited:false

                                                                                                                                                              General

                                                                                                                                                              Target ID:12
                                                                                                                                                              Start time:15:39:09
                                                                                                                                                              Start date:18/07/2024
                                                                                                                                                              Path:C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:"C:\Windows\Temp\asw.481015ae89dc80a3\avg_antivirus_free_online_setup.exe" /silent /ws /psh:92pTu5fbOaMVqHXWzRazGwcsjZOgyQNZV0BXrS1y4TWZ27PXSitlzA5vE30PraTCAoRM4emN7pEfhI /cookie:mmm_irs_ppi_902_451_o /ga_clientid:1840c678-d62a-4945-8e4f-36eaf3f0c4a5 /edat_dir:C:\Windows\Temp\asw.481015ae89dc80a3
                                                                                                                                                              Imagebase:0xcc0000
                                                                                                                                                              File size:1'627'112 bytes
                                                                                                                                                              MD5 hash:89799311702BD341AA9B7DAEE903B5C2
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Antivirus matches:
                                                                                                                                                              • Detection: 0%, ReversingLabs
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:false

                                                                                                                                                              General

                                                                                                                                                              Target ID:13
                                                                                                                                                              Start time:15:39:10
                                                                                                                                                              Start date:18/07/2024
                                                                                                                                                              Path:C:\Program Files\BitComet\BitComet.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:"C:\Program Files\BitComet\BitComet.exe" --no_elevated
                                                                                                                                                              Imagebase:0x7ff663ea0000
                                                                                                                                                              File size:27'838'352 bytes
                                                                                                                                                              MD5 hash:BFDFE1495ADA381F3D57C6E6DF04E189
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Antivirus matches:
                                                                                                                                                              • Detection: 4%, ReversingLabs
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:14
                                                                                                                                                              Start time:15:39:11
                                                                                                                                                              Start date:18/07/2024
                                                                                                                                                              Path:C:\Program Files\BitComet\BitComet.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:"C:\Program Files\BitComet\BitComet.exe"
                                                                                                                                                              Imagebase:0x7ff663ea0000
                                                                                                                                                              File size:27'838'352 bytes
                                                                                                                                                              MD5 hash:BFDFE1495ADA381F3D57C6E6DF04E189
                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:false

                                                                                                                                                              General

                                                                                                                                                              Target ID:15
                                                                                                                                                              Start time:15:39:12
                                                                                                                                                              Start date:18/07/2024
                                                                                                                                                              Path:C:\Program Files\BitComet\tools\BitCometService.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:"C:\Program Files\BitComet\tools\BitCometService.exe" -service
                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                              File size:2'682'920 bytes
                                                                                                                                                              MD5 hash:AE7FBFF183FF30913EBEB38913E8CFAD
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Yara matches:
                                                                                                                                                              • Rule: JoeSecurity_PrivateLoader, Description: Yara detected PrivateLoader, Source: 0000000F.00000000.2414944136.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_PrivateLoader, Description: Yara detected PrivateLoader, Source: 0000000F.00000002.2966448744.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Author: Joe Security
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:false

                                                                                                                                                              General

                                                                                                                                                              Target ID:16
                                                                                                                                                              Start time:15:39:13
                                                                                                                                                              Start date:18/07/2024
                                                                                                                                                              Path:C:\Program Files\BitComet\tools\UPNP.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:"C:\Program Files\BitComet\tools\UPNP.exe" -addfw -app BitComet -tcpport 9652 -udpport 9652 -q
                                                                                                                                                              Imagebase:0xb00000
                                                                                                                                                              File size:820'528 bytes
                                                                                                                                                              MD5 hash:FEBBAF0C03103A63E0141A96535B7745
                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Antivirus matches:
                                                                                                                                                              • Detection: 0%, ReversingLabs
                                                                                                                                                              Reputation:low
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:17
                                                                                                                                                              Start time:15:39:13
                                                                                                                                                              Start date:18/07/2024
                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                                                                                                                              Imagebase:0x7ff6eef20000
                                                                                                                                                              File size:55'320 bytes
                                                                                                                                                              MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:high
                                                                                                                                                              Has exited:false

                                                                                                                                                              General

                                                                                                                                                              Target ID:18
                                                                                                                                                              Start time:15:39:14
                                                                                                                                                              Start date:18/07/2024
                                                                                                                                                              Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 6740 -ip 6740
                                                                                                                                                              Imagebase:0xf00000
                                                                                                                                                              File size:483'680 bytes
                                                                                                                                                              MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:high
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:19
                                                                                                                                                              Start time:15:39:14
                                                                                                                                                              Start date:18/07/2024
                                                                                                                                                              Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 6740 -s 968
                                                                                                                                                              Imagebase:0xf00000
                                                                                                                                                              File size:483'680 bytes
                                                                                                                                                              MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:20
                                                                                                                                                              Start time:15:39:15
                                                                                                                                                              Start date:18/07/2024
                                                                                                                                                              Path:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=6032.3612.7348265561393428437
                                                                                                                                                              Imagebase:0x7ff664d80000
                                                                                                                                                              File size:3'749'328 bytes
                                                                                                                                                              MD5 hash:9909D978B39FB7369F511D8506C17CA0
                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Has exited:false

                                                                                                                                                              General

                                                                                                                                                              Target ID:21
                                                                                                                                                              Start time:15:39:16
                                                                                                                                                              Start date:18/07/2024
                                                                                                                                                              Path:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Local\BitComet\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Local\BitComet\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x15c,0x160,0x164,0x138,0x170,0x7ffdfab78e88,0x7ffdfab78e98,0x7ffdfab78ea8
                                                                                                                                                              Imagebase:0x7ff664d80000
                                                                                                                                                              File size:3'749'328 bytes
                                                                                                                                                              MD5 hash:9909D978B39FB7369F511D8506C17CA0
                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Has exited:false

                                                                                                                                                              General

                                                                                                                                                              Target ID:22
                                                                                                                                                              Start time:15:39:16
                                                                                                                                                              Start date:18/07/2024
                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                                                              Imagebase:0x7ff6eef20000
                                                                                                                                                              File size:55'320 bytes
                                                                                                                                                              MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Has exited:false

                                                                                                                                                              General

                                                                                                                                                              Target ID:23
                                                                                                                                                              Start time:15:39:17
                                                                                                                                                              Start date:18/07/2024
                                                                                                                                                              Path:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2484 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:2
                                                                                                                                                              Imagebase:0x7ff664d80000
                                                                                                                                                              File size:3'749'328 bytes
                                                                                                                                                              MD5 hash:9909D978B39FB7369F511D8506C17CA0
                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Has exited:false

                                                                                                                                                              General

                                                                                                                                                              Target ID:24
                                                                                                                                                              Start time:15:39:17
                                                                                                                                                              Start date:18/07/2024
                                                                                                                                                              Path:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2924 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:3
                                                                                                                                                              Imagebase:0x7ff664d80000
                                                                                                                                                              File size:3'749'328 bytes
                                                                                                                                                              MD5 hash:9909D978B39FB7369F511D8506C17CA0
                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Has exited:false

                                                                                                                                                              General

                                                                                                                                                              Target ID:25
                                                                                                                                                              Start time:15:39:17
                                                                                                                                                              Start date:18/07/2024
                                                                                                                                                              Path:C:\Program Files\BitComet\tools\UPNP.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:"C:\Program Files\BitComet\tools\UPNP.exe" -add -app BitComet -lanip 192.168.2.4 -tcpport 9652 -udpport 9652 -q
                                                                                                                                                              Imagebase:0xb00000
                                                                                                                                                              File size:820'528 bytes
                                                                                                                                                              MD5 hash:FEBBAF0C03103A63E0141A96535B7745
                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:26
                                                                                                                                                              Start time:15:39:18
                                                                                                                                                              Start date:18/07/2024
                                                                                                                                                              Path:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2920 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:8
                                                                                                                                                              Imagebase:0x7ff664d80000
                                                                                                                                                              File size:3'749'328 bytes
                                                                                                                                                              MD5 hash:9909D978B39FB7369F511D8506C17CA0
                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Has exited:false

                                                                                                                                                              General

                                                                                                                                                              Target ID:27
                                                                                                                                                              Start time:15:39:18
                                                                                                                                                              Start date:18/07/2024
                                                                                                                                                              Path:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6693313984 --mojo-platform-channel-handle=3272 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:1
                                                                                                                                                              Imagebase:0x7ff664d80000
                                                                                                                                                              File size:3'749'328 bytes
                                                                                                                                                              MD5 hash:9909D978B39FB7369F511D8506C17CA0
                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:28
                                                                                                                                                              Start time:15:39:18
                                                                                                                                                              Start date:18/07/2024
                                                                                                                                                              Path:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6693485965 --mojo-platform-channel-handle=3588 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:1
                                                                                                                                                              Imagebase:0x7ff664d80000
                                                                                                                                                              File size:3'749'328 bytes
                                                                                                                                                              MD5 hash:9909D978B39FB7369F511D8506C17CA0
                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:29
                                                                                                                                                              Start time:15:39:18
                                                                                                                                                              Start date:18/07/2024
                                                                                                                                                              Path:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6693635288 --mojo-platform-channel-handle=3776 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:1
                                                                                                                                                              Imagebase:0x7ff664d80000
                                                                                                                                                              File size:3'749'328 bytes
                                                                                                                                                              MD5 hash:9909D978B39FB7369F511D8506C17CA0
                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Has exited:false

                                                                                                                                                              General

                                                                                                                                                              Target ID:30
                                                                                                                                                              Start time:15:39:18
                                                                                                                                                              Start date:18/07/2024
                                                                                                                                                              Path:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6693754114 --mojo-platform-channel-handle=4048 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:1
                                                                                                                                                              Imagebase:0x7ff664d80000
                                                                                                                                                              File size:3'749'328 bytes
                                                                                                                                                              MD5 hash:9909D978B39FB7369F511D8506C17CA0
                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Has exited:false

                                                                                                                                                              General

                                                                                                                                                              Target ID:33
                                                                                                                                                              Start time:15:39:22
                                                                                                                                                              Start date:18/07/2024
                                                                                                                                                              Path:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --disable-gpu-compositing --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6697808392 --mojo-platform-channel-handle=4692 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:1
                                                                                                                                                              Imagebase:0x7ff664d80000
                                                                                                                                                              File size:3'749'328 bytes
                                                                                                                                                              MD5 hash:9909D978B39FB7369F511D8506C17CA0
                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Has exited:false

                                                                                                                                                              General

                                                                                                                                                              Target ID:34
                                                                                                                                                              Start time:15:39:23
                                                                                                                                                              Start date:18/07/2024
                                                                                                                                                              Path:C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\BitComet\EBWebView" --webview-exe-name=BitComet.exe --webview-exe-version=2.08 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-nacl --disable-gpu-compositing --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1721324864909880 --launch-time-ticks=6698303265 --mojo-platform-channel-handle=4760 --field-trial-handle=2496,i,9344401132103162842,1077608115730467345,262144 --enable-features=MojoIpcz /prefetch:1
                                                                                                                                                              Imagebase:0x7ff664d80000
                                                                                                                                                              File size:3'749'328 bytes
                                                                                                                                                              MD5 hash:9909D978B39FB7369F511D8506C17CA0
                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Has exited:false

                                                                                                                                                              General

                                                                                                                                                              Target ID:37
                                                                                                                                                              Start time:15:39:28
                                                                                                                                                              Start date:18/07/2024
                                                                                                                                                              Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 6740 -ip 6740
                                                                                                                                                              Imagebase:0xf00000
                                                                                                                                                              File size:483'680 bytes
                                                                                                                                                              MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:38
                                                                                                                                                              Start time:15:39:28
                                                                                                                                                              Start date:18/07/2024
                                                                                                                                                              Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 6740 -s 968
                                                                                                                                                              Imagebase:0xf00000
                                                                                                                                                              File size:483'680 bytes
                                                                                                                                                              MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Has exited:true

                                                                                                                                                              General

                                                                                                                                                              Target ID:39
                                                                                                                                                              Start time:15:39:34
                                                                                                                                                              Start date:18/07/2024
                                                                                                                                                              Path:C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-486ccf90-af98-43bc-87a3-331aebaa6706\icarus-info.xml /install /silent /ws /psh:92pTu5fbOaMVqHXWzRazGwcsjZOgyQNZV0BXrS1y4TWZ27PXSitlzA5vE30PraTCAoRM4emN7pEfhI /cookie:mmm_irs_ppi_902_451_o /edat_dir:C:\Windows\Temp\asw.481015ae89dc80a3 /track-guid:1840c678-d62a-4945-8e4f-36eaf3f0c4a5
                                                                                                                                                              Imagebase:0x7ff78f530000
                                                                                                                                                              File size:8'027'576 bytes
                                                                                                                                                              MD5 hash:251369428A0E2D87308E7A9FAA387270
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Antivirus matches:
                                                                                                                                                              • Detection: 0%, ReversingLabs
                                                                                                                                                              Has exited:false

                                                                                                                                                              General

                                                                                                                                                              Target ID:40
                                                                                                                                                              Start time:15:39:44
                                                                                                                                                              Start date:18/07/2024
                                                                                                                                                              Path:C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\installer.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:"C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\\installer.exe" /setOem:Affid=91088 /s /thirdparty /upgrade
                                                                                                                                                              Imagebase:0x7ff7cc7a0000
                                                                                                                                                              File size:29'504'216 bytes
                                                                                                                                                              MD5 hash:E1DD69840A8965E125AA7F311B6D8EFB
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Antivirus matches:
                                                                                                                                                              • Detection: 0%, ReversingLabs
                                                                                                                                                              Has exited:true

                                                                                                                                                              Disassembly

                                                                                                                                                              Reset < >

                                                                                                                                                                Execution Graph

                                                                                                                                                                Execution Coverage:21.4%
                                                                                                                                                                Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                Signature Coverage:20%
                                                                                                                                                                Total number of Nodes:1368
                                                                                                                                                                Total number of Limit Nodes:32
                                                                                                                                                                execution_graph 3189 401941 3190 401943 3189->3190 3195 402c41 3190->3195 3196 402c4d 3195->3196 3237 40640a 3196->3237 3199 401948 3201 405afa 3199->3201 3279 405dc5 3201->3279 3204 405b22 DeleteFileW 3234 401951 3204->3234 3205 405b39 3206 405c59 3205->3206 3293 4063e8 lstrcpynW 3205->3293 3206->3234 3323 40672b FindFirstFileW 3206->3323 3208 405b5f 3209 405b72 3208->3209 3210 405b65 lstrcatW 3208->3210 3294 405d09 lstrlenW 3209->3294 3211 405b78 3210->3211 3214 405b88 lstrcatW 3211->3214 3216 405b93 lstrlenW FindFirstFileW 3211->3216 3214->3216 3216->3206 3226 405bb5 3216->3226 3219 405ab2 5 API calls 3222 405c94 3219->3222 3221 405c3c FindNextFileW 3223 405c52 FindClose 3221->3223 3221->3226 3224 405c98 3222->3224 3225 405cae 3222->3225 3223->3206 3229 405450 24 API calls 3224->3229 3224->3234 3228 405450 24 API calls 3225->3228 3226->3221 3230 405afa 60 API calls 3226->3230 3232 405450 24 API calls 3226->3232 3298 4063e8 lstrcpynW 3226->3298 3299 405ab2 3226->3299 3307 405450 3226->3307 3318 4061ae MoveFileExW 3226->3318 3228->3234 3231 405ca5 3229->3231 3230->3226 3233 4061ae 36 API calls 3231->3233 3232->3221 3233->3234 3245 406417 3237->3245 3238 406662 3239 402c6e 3238->3239 3270 4063e8 lstrcpynW 3238->3270 3239->3199 3254 40667c 3239->3254 3241 406630 lstrlenW 3241->3245 3242 40640a 10 API calls 3242->3241 3245->3238 3245->3241 3245->3242 3246 406545 GetSystemDirectoryW 3245->3246 3248 406558 GetWindowsDirectoryW 3245->3248 3249 40667c 5 API calls 3245->3249 3250 40640a 10 API calls 3245->3250 3251 4065d3 lstrcatW 3245->3251 3252 40658c SHGetSpecialFolderLocation 3245->3252 3263 4062b6 3245->3263 3268 40632f wsprintfW 3245->3268 3269 4063e8 lstrcpynW 3245->3269 3246->3245 3248->3245 3249->3245 3250->3245 3251->3245 3252->3245 3253 4065a4 SHGetPathFromIDListW CoTaskMemFree 3252->3253 3253->3245 3255 406689 3254->3255 3257 4066f2 CharNextW 3255->3257 3260 4066ff 3255->3260 3261 4066de CharNextW 3255->3261 3262 4066ed CharNextW 3255->3262 3275 405cea 3255->3275 3256 406704 CharPrevW 3256->3260 3257->3255 3257->3260 3258 406725 3258->3199 3260->3256 3260->3258 3261->3255 3262->3257 3271 406255 3263->3271 3266 4062ea RegQueryValueExW RegCloseKey 3267 40631a 3266->3267 3267->3245 3268->3245 3269->3245 3270->3239 3272 406264 3271->3272 3273 406268 3272->3273 3274 40626d RegOpenKeyExW 3272->3274 3273->3266 3273->3267 3274->3273 3276 405cf0 3275->3276 3277 405d06 3276->3277 3278 405cf7 CharNextW 3276->3278 3277->3255 3278->3276 3329 4063e8 lstrcpynW 3279->3329 3281 405dd6 3330 405d68 CharNextW CharNextW 3281->3330 3284 405b1a 3284->3204 3284->3205 3285 40667c 5 API calls 3291 405dec 3285->3291 3286 405e1d lstrlenW 3287 405e28 3286->3287 3286->3291 3289 405cbd 3 API calls 3287->3289 3288 40672b 2 API calls 3288->3291 3290 405e2d GetFileAttributesW 3289->3290 3290->3284 3291->3284 3291->3286 3291->3288 3292 405d09 2 API calls 3291->3292 3292->3286 3293->3208 3295 405d17 3294->3295 3296 405d29 3295->3296 3297 405d1d CharPrevW 3295->3297 3296->3211 3297->3295 3297->3296 3298->3226 3336 405eb9 GetFileAttributesW 3299->3336 3302 405ad5 DeleteFileW 3304 405adb 3302->3304 3303 405acd RemoveDirectoryW 3303->3304 3305 405adf 3304->3305 3306 405aeb SetFileAttributesW 3304->3306 3305->3226 3306->3305 3308 40546b 3307->3308 3317 40550d 3307->3317 3309 405487 lstrlenW 3308->3309 3310 40640a 17 API calls 3308->3310 3311 4054b0 3309->3311 3312 405495 lstrlenW 3309->3312 3310->3309 3314 4054c3 3311->3314 3315 4054b6 SetWindowTextW 3311->3315 3313 4054a7 lstrcatW 3312->3313 3312->3317 3313->3311 3316 4054c9 SendMessageW SendMessageW SendMessageW 3314->3316 3314->3317 3315->3314 3316->3317 3317->3226 3319 4061d1 3318->3319 3320 4061c2 3318->3320 3319->3226 3339 406034 3320->3339 3324 406741 FindClose 3323->3324 3325 405c7e 3323->3325 3324->3325 3325->3234 3326 405cbd lstrlenW CharPrevW 3325->3326 3327 405c88 3326->3327 3328 405cd9 lstrcatW 3326->3328 3327->3219 3328->3327 3329->3281 3331 405d85 3330->3331 3335 405d97 3330->3335 3332 405d92 CharNextW 3331->3332 3331->3335 3333 405dbb 3332->3333 3333->3284 3333->3285 3334 405cea CharNextW 3334->3335 3335->3333 3335->3334 3337 405abe 3336->3337 3338 405ecb SetFileAttributesW 3336->3338 3337->3302 3337->3303 3337->3305 3338->3337 3340 406064 3339->3340 3341 40608a GetShortPathNameW 3339->3341 3366 405ede GetFileAttributesW CreateFileW 3340->3366 3343 4061a9 3341->3343 3344 40609f 3341->3344 3343->3319 3344->3343 3346 4060a7 wsprintfA 3344->3346 3345 40606e CloseHandle GetShortPathNameW 3345->3343 3347 406082 3345->3347 3348 40640a 17 API calls 3346->3348 3347->3341 3347->3343 3349 4060cf 3348->3349 3367 405ede GetFileAttributesW CreateFileW 3349->3367 3351 4060dc 3351->3343 3352 4060eb GetFileSize GlobalAlloc 3351->3352 3353 4061a2 CloseHandle 3352->3353 3354 40610d 3352->3354 3353->3343 3368 405f61 ReadFile 3354->3368 3359 406140 3361 405e43 4 API calls 3359->3361 3360 40612c lstrcpyA 3362 40614e 3360->3362 3361->3362 3363 406185 SetFilePointer 3362->3363 3375 405f90 WriteFile 3363->3375 3366->3345 3367->3351 3369 405f7f 3368->3369 3369->3353 3370 405e43 lstrlenA 3369->3370 3371 405e84 lstrlenA 3370->3371 3372 405e8c 3371->3372 3373 405e5d lstrcmpiA 3371->3373 3372->3359 3372->3360 3373->3372 3374 405e7b CharNextA 3373->3374 3374->3371 3376 405fae GlobalFree 3375->3376 3376->3353 3377 4015c1 3378 402c41 17 API calls 3377->3378 3379 4015c8 3378->3379 3380 405d68 4 API calls 3379->3380 3390 4015d1 3380->3390 3381 401631 3383 401663 3381->3383 3384 401636 3381->3384 3382 405cea CharNextW 3382->3390 3386 401423 24 API calls 3383->3386 3404 401423 3384->3404 3394 40165b 3386->3394 3390->3381 3390->3382 3393 401617 GetFileAttributesW 3390->3393 3396 4059b9 3390->3396 3399 40591f CreateDirectoryW 3390->3399 3408 40599c CreateDirectoryW 3390->3408 3392 40164a SetCurrentDirectoryW 3392->3394 3393->3390 3411 4067c2 GetModuleHandleA 3396->3411 3400 405970 GetLastError 3399->3400 3401 40596c 3399->3401 3400->3401 3402 40597f SetFileSecurityW 3400->3402 3401->3390 3402->3401 3403 405995 GetLastError 3402->3403 3403->3401 3405 405450 24 API calls 3404->3405 3406 401431 3405->3406 3407 4063e8 lstrcpynW 3406->3407 3407->3392 3409 4059b0 GetLastError 3408->3409 3410 4059ac 3408->3410 3409->3410 3410->3390 3412 4067e8 GetProcAddress 3411->3412 3413 4067de 3411->3413 3415 4059c0 3412->3415 3417 406752 GetSystemDirectoryW 3413->3417 3415->3390 3416 4067e4 3416->3412 3416->3415 3418 406774 wsprintfW LoadLibraryExW 3417->3418 3418->3416 3994 4053c4 3995 4053d4 3994->3995 3996 4053e8 3994->3996 3997 405431 3995->3997 3998 4053da 3995->3998 3999 4053f0 IsWindowVisible 3996->3999 4005 405407 3996->4005 4000 405436 CallWindowProcW 3997->4000 4001 4043ab SendMessageW 3998->4001 3999->3997 4002 4053fd 3999->4002 4003 4053e4 4000->4003 4001->4003 4007 404d1a SendMessageW 4002->4007 4005->4000 4012 404d9a 4005->4012 4008 404d79 SendMessageW 4007->4008 4009 404d3d GetMessagePos ScreenToClient SendMessageW 4007->4009 4010 404d71 4008->4010 4009->4010 4011 404d76 4009->4011 4010->4005 4011->4008 4021 4063e8 lstrcpynW 4012->4021 4014 404dad 4022 40632f wsprintfW 4014->4022 4016 404db7 4017 40140b 2 API calls 4016->4017 4018 404dc0 4017->4018 4023 4063e8 lstrcpynW 4018->4023 4020 404dc7 4020->3997 4021->4014 4022->4016 4023->4020 4024 401e49 4025 402c1f 17 API calls 4024->4025 4026 401e4f 4025->4026 4027 402c1f 17 API calls 4026->4027 4028 401e5b 4027->4028 4029 401e72 EnableWindow 4028->4029 4030 401e67 ShowWindow 4028->4030 4031 402ac5 4029->4031 4030->4031 4032 40264a 4033 402c1f 17 API calls 4032->4033 4040 402659 4033->4040 4034 4026a3 ReadFile 4034->4040 4044 402796 4034->4044 4035 405f61 ReadFile 4035->4040 4036 4026e3 MultiByteToWideChar 4036->4040 4037 402798 4054 40632f wsprintfW 4037->4054 4040->4034 4040->4035 4040->4036 4040->4037 4041 402709 SetFilePointer MultiByteToWideChar 4040->4041 4042 4027a9 4040->4042 4040->4044 4045 405fbf SetFilePointer 4040->4045 4041->4040 4043 4027ca SetFilePointer 4042->4043 4042->4044 4043->4044 4046 405fdb 4045->4046 4053 405ff3 4045->4053 4047 405f61 ReadFile 4046->4047 4048 405fe7 4047->4048 4049 406024 SetFilePointer 4048->4049 4050 405ffc SetFilePointer 4048->4050 4048->4053 4049->4053 4050->4049 4051 406007 4050->4051 4052 405f90 WriteFile 4051->4052 4052->4053 4053->4040 4054->4044 4058 404dcc GetDlgItem GetDlgItem 4059 404e1e 7 API calls 4058->4059 4068 405037 4058->4068 4060 404ec1 DeleteObject 4059->4060 4061 404eb4 SendMessageW 4059->4061 4062 404eca 4060->4062 4061->4060 4063 404f01 4062->4063 4067 40640a 17 API calls 4062->4067 4109 40435f 4063->4109 4064 40511b 4066 4051c7 4064->4066 4075 405174 SendMessageW 4064->4075 4101 40502a 4064->4101 4070 4051d1 SendMessageW 4066->4070 4071 4051d9 4066->4071 4072 404ee3 SendMessageW SendMessageW 4067->4072 4068->4064 4073 404d1a 5 API calls 4068->4073 4092 4050a8 4068->4092 4069 404f15 4074 40435f 18 API calls 4069->4074 4070->4071 4078 4051f2 4071->4078 4079 4051eb ImageList_Destroy 4071->4079 4095 405202 4071->4095 4072->4062 4073->4092 4094 404f23 4074->4094 4080 405189 SendMessageW 4075->4080 4075->4101 4077 40510d SendMessageW 4077->4064 4082 4051fb GlobalFree 4078->4082 4078->4095 4079->4078 4084 40519c 4080->4084 4082->4095 4083 404ff8 GetWindowLongW SetWindowLongW 4086 405011 4083->4086 4096 4051ad SendMessageW 4084->4096 4085 405371 4087 405383 ShowWindow GetDlgItem ShowWindow 4085->4087 4085->4101 4088 405017 ShowWindow 4086->4088 4089 40502f 4086->4089 4087->4101 4112 404394 SendMessageW 4088->4112 4113 404394 SendMessageW 4089->4113 4092->4064 4092->4077 4093 404f73 SendMessageW 4093->4094 4094->4083 4094->4093 4097 404ff2 4094->4097 4098 404fc0 SendMessageW 4094->4098 4099 404faf SendMessageW 4094->4099 4095->4085 4100 404d9a 4 API calls 4095->4100 4105 40523d 4095->4105 4096->4066 4097->4083 4097->4086 4098->4094 4099->4094 4100->4105 4117 4043c6 4101->4117 4102 405347 InvalidateRect 4102->4085 4103 40535d 4102->4103 4114 404cd5 4103->4114 4104 40526b SendMessageW 4108 405281 4104->4108 4105->4104 4105->4108 4107 4052f5 SendMessageW SendMessageW 4107->4108 4108->4102 4108->4107 4110 40640a 17 API calls 4109->4110 4111 40436a SetDlgItemTextW 4110->4111 4111->4069 4112->4101 4113->4068 4131 404c0c 4114->4131 4116 404cea 4116->4085 4118 404489 4117->4118 4119 4043de GetWindowLongW 4117->4119 4119->4118 4120 4043f3 4119->4120 4120->4118 4121 404420 GetSysColor 4120->4121 4122 404423 4120->4122 4121->4122 4123 404433 SetBkMode 4122->4123 4124 404429 SetTextColor 4122->4124 4125 404451 4123->4125 4126 40444b GetSysColor 4123->4126 4124->4123 4127 404458 SetBkColor 4125->4127 4128 404462 4125->4128 4126->4125 4127->4128 4128->4118 4129 404475 DeleteObject 4128->4129 4130 40447c CreateBrushIndirect 4128->4130 4129->4130 4130->4118 4132 404c25 4131->4132 4133 40640a 17 API calls 4132->4133 4134 404c89 4133->4134 4135 40640a 17 API calls 4134->4135 4136 404c94 4135->4136 4137 40640a 17 API calls 4136->4137 4138 404caa lstrlenW wsprintfW SetDlgItemTextW 4137->4138 4138->4116 4139 4016cc 4140 402c41 17 API calls 4139->4140 4141 4016d2 GetFullPathNameW 4140->4141 4142 4016ec 4141->4142 4148 40170e 4141->4148 4144 40672b 2 API calls 4142->4144 4142->4148 4143 401723 GetShortPathNameW 4145 402ac5 4143->4145 4146 4016fe 4144->4146 4146->4148 4149 4063e8 lstrcpynW 4146->4149 4148->4143 4148->4145 4149->4148 4150 40234e 4151 402c41 17 API calls 4150->4151 4152 40235d 4151->4152 4153 402c41 17 API calls 4152->4153 4154 402366 4153->4154 4155 402c41 17 API calls 4154->4155 4156 402370 GetPrivateProfileStringW 4155->4156 4157 4044cf lstrlenW 4158 4044f0 WideCharToMultiByte 4157->4158 4159 4044ee 4157->4159 4159->4158 4160 404850 4161 40487c 4160->4161 4162 40488d 4160->4162 4221 405a32 GetDlgItemTextW 4161->4221 4164 404899 GetDlgItem 4162->4164 4170 4048f8 4162->4170 4166 4048ad 4164->4166 4165 404887 4168 40667c 5 API calls 4165->4168 4169 4048c1 SetWindowTextW 4166->4169 4173 405d68 4 API calls 4166->4173 4167 4049dc 4219 404b8b 4167->4219 4223 405a32 GetDlgItemTextW 4167->4223 4168->4162 4174 40435f 18 API calls 4169->4174 4170->4167 4175 40640a 17 API calls 4170->4175 4170->4219 4172 4043c6 8 API calls 4177 404b9f 4172->4177 4178 4048b7 4173->4178 4179 4048dd 4174->4179 4180 40496c SHBrowseForFolderW 4175->4180 4176 404a0c 4181 405dc5 18 API calls 4176->4181 4178->4169 4187 405cbd 3 API calls 4178->4187 4182 40435f 18 API calls 4179->4182 4180->4167 4183 404984 CoTaskMemFree 4180->4183 4184 404a12 4181->4184 4185 4048eb 4182->4185 4186 405cbd 3 API calls 4183->4186 4224 4063e8 lstrcpynW 4184->4224 4222 404394 SendMessageW 4185->4222 4189 404991 4186->4189 4187->4169 4192 4049c8 SetDlgItemTextW 4189->4192 4196 40640a 17 API calls 4189->4196 4191 4048f1 4194 4067c2 5 API calls 4191->4194 4192->4167 4193 404a29 4195 4067c2 5 API calls 4193->4195 4194->4170 4197 404a30 4195->4197 4198 4049b0 lstrcmpiW 4196->4198 4199 404a71 4197->4199 4207 405d09 2 API calls 4197->4207 4209 404ac9 4197->4209 4198->4192 4201 4049c1 lstrcatW 4198->4201 4225 4063e8 lstrcpynW 4199->4225 4201->4192 4202 404a78 4203 405d68 4 API calls 4202->4203 4204 404a7e GetDiskFreeSpaceW 4203->4204 4206 404aa2 MulDiv 4204->4206 4204->4209 4206->4209 4207->4197 4208 404b3a 4211 404b5d 4208->4211 4213 40140b 2 API calls 4208->4213 4209->4208 4210 404cd5 20 API calls 4209->4210 4212 404b27 4210->4212 4226 404381 EnableWindow 4211->4226 4215 404b3c SetDlgItemTextW 4212->4215 4216 404b2c 4212->4216 4213->4211 4215->4208 4218 404c0c 20 API calls 4216->4218 4217 404b79 4217->4219 4227 4047a9 4217->4227 4218->4208 4219->4172 4221->4165 4222->4191 4223->4176 4224->4193 4225->4202 4226->4217 4228 4047b7 4227->4228 4229 4047bc SendMessageW 4227->4229 4228->4229 4229->4219 4230 401b53 4231 402c41 17 API calls 4230->4231 4232 401b5a 4231->4232 4233 402c1f 17 API calls 4232->4233 4234 401b63 wsprintfW 4233->4234 4235 402ac5 4234->4235 4236 401956 4237 402c41 17 API calls 4236->4237 4238 40195d lstrlenW 4237->4238 4239 402592 4238->4239 4247 4014d7 4248 402c1f 17 API calls 4247->4248 4249 4014dd Sleep 4248->4249 4251 402ac5 4249->4251 4252 401f58 4253 402c41 17 API calls 4252->4253 4254 401f5f 4253->4254 4255 40672b 2 API calls 4254->4255 4256 401f65 4255->4256 4258 401f76 4256->4258 4259 40632f wsprintfW 4256->4259 4259->4258 4260 402259 4261 402c41 17 API calls 4260->4261 4262 40225f 4261->4262 4263 402c41 17 API calls 4262->4263 4264 402268 4263->4264 4265 402c41 17 API calls 4264->4265 4266 402271 4265->4266 4267 40672b 2 API calls 4266->4267 4268 40227a 4267->4268 4269 40228b lstrlenW lstrlenW 4268->4269 4270 40227e 4268->4270 4272 405450 24 API calls 4269->4272 4271 405450 24 API calls 4270->4271 4274 402286 4270->4274 4271->4274 4273 4022c9 SHFileOperationW 4272->4273 4273->4270 4273->4274 3988 40175c 3989 402c41 17 API calls 3988->3989 3990 401763 3989->3990 3991 405f0d 2 API calls 3990->3991 3992 40176a 3991->3992 3993 405f0d 2 API calls 3992->3993 3993->3992 4275 401d5d GetDlgItem GetClientRect 4276 402c41 17 API calls 4275->4276 4277 401d8f LoadImageW SendMessageW 4276->4277 4278 401dad DeleteObject 4277->4278 4279 402ac5 4277->4279 4278->4279 4280 4022dd 4281 4022e4 4280->4281 4284 4022f7 4280->4284 4282 40640a 17 API calls 4281->4282 4283 4022f1 4282->4283 4285 405a4e MessageBoxIndirectW 4283->4285 4285->4284 4286 401563 4287 402a6b 4286->4287 4290 40632f wsprintfW 4287->4290 4289 402a70 4290->4289 3420 4023e4 3421 402c41 17 API calls 3420->3421 3422 4023f6 3421->3422 3423 402c41 17 API calls 3422->3423 3424 402400 3423->3424 3437 402cd1 3424->3437 3427 402ac5 3428 402438 3433 402444 3428->3433 3441 402c1f 3428->3441 3429 402c41 17 API calls 3430 40242e lstrlenW 3429->3430 3430->3428 3432 402463 RegSetValueExW 3435 402479 RegCloseKey 3432->3435 3433->3432 3444 4031d6 3433->3444 3435->3427 3438 402cec 3437->3438 3459 406283 3438->3459 3442 40640a 17 API calls 3441->3442 3443 402c34 3442->3443 3443->3433 3445 403201 3444->3445 3446 4031e5 SetFilePointer 3444->3446 3463 4032de GetTickCount 3445->3463 3446->3445 3449 405f61 ReadFile 3450 403221 3449->3450 3451 4032de 42 API calls 3450->3451 3453 40329e 3450->3453 3452 403238 3451->3452 3452->3453 3454 4032a4 ReadFile 3452->3454 3456 403247 3452->3456 3453->3432 3454->3453 3456->3453 3457 405f61 ReadFile 3456->3457 3458 405f90 WriteFile 3456->3458 3457->3456 3458->3456 3460 406292 3459->3460 3461 402410 3460->3461 3462 40629d RegCreateKeyExW 3460->3462 3461->3427 3461->3428 3461->3429 3462->3461 3464 403436 3463->3464 3465 40330c 3463->3465 3466 402e8e 32 API calls 3464->3466 3476 40345d SetFilePointer 3465->3476 3472 403208 3466->3472 3468 403317 SetFilePointer 3474 40333c 3468->3474 3472->3449 3472->3453 3473 405f90 WriteFile 3473->3474 3474->3472 3474->3473 3475 403417 SetFilePointer 3474->3475 3477 403447 3474->3477 3480 406943 3474->3480 3487 402e8e 3474->3487 3475->3464 3476->3468 3478 405f61 ReadFile 3477->3478 3479 40345a 3478->3479 3479->3474 3481 406968 3480->3481 3482 406970 3480->3482 3481->3474 3482->3481 3483 406a00 GlobalAlloc 3482->3483 3484 4069f7 GlobalFree 3482->3484 3485 406a77 GlobalAlloc 3482->3485 3486 406a6e GlobalFree 3482->3486 3483->3481 3483->3482 3484->3483 3485->3481 3485->3482 3486->3485 3488 402eb7 3487->3488 3489 402e9f 3487->3489 3491 402ec7 GetTickCount 3488->3491 3492 402ebf 3488->3492 3490 402ea8 DestroyWindow 3489->3490 3495 402eaf 3489->3495 3490->3495 3494 402ed5 3491->3494 3491->3495 3502 4067fe 3492->3502 3496 402f0a CreateDialogParamW ShowWindow 3494->3496 3497 402edd 3494->3497 3495->3474 3496->3495 3497->3495 3506 402e72 3497->3506 3499 402eeb wsprintfW 3500 405450 24 API calls 3499->3500 3501 402f08 3500->3501 3501->3495 3503 40681b PeekMessageW 3502->3503 3504 406811 DispatchMessageW 3503->3504 3505 40682b 3503->3505 3504->3503 3505->3495 3507 402e81 3506->3507 3508 402e83 MulDiv 3506->3508 3507->3508 3508->3499 3783 4039e6 3784 403a01 3783->3784 3785 4039f7 CloseHandle 3783->3785 3786 403a15 3784->3786 3787 403a0b CloseHandle 3784->3787 3785->3784 3792 403a43 3786->3792 3787->3786 3790 405afa 67 API calls 3791 403a26 3790->3791 3793 403a51 3792->3793 3794 403a1a 3793->3794 3795 403a56 FreeLibrary GlobalFree 3793->3795 3794->3790 3795->3794 3795->3795 4298 401968 4299 402c1f 17 API calls 4298->4299 4300 40196f 4299->4300 4301 402c1f 17 API calls 4300->4301 4302 40197c 4301->4302 4303 402c41 17 API calls 4302->4303 4304 401993 lstrlenW 4303->4304 4306 4019a4 4304->4306 4305 4019e5 4306->4305 4310 4063e8 lstrcpynW 4306->4310 4308 4019d5 4308->4305 4309 4019da lstrlenW 4308->4309 4309->4305 4310->4308 4311 402868 4312 402c41 17 API calls 4311->4312 4313 40286f FindFirstFileW 4312->4313 4314 402897 4313->4314 4317 402882 4313->4317 4319 40632f wsprintfW 4314->4319 4316 4028a0 4320 4063e8 lstrcpynW 4316->4320 4319->4316 4320->4317 4321 40166a 4322 402c41 17 API calls 4321->4322 4323 401670 4322->4323 4324 40672b 2 API calls 4323->4324 4325 401676 4324->4325 3890 40176f 3891 402c41 17 API calls 3890->3891 3892 401776 3891->3892 3893 401796 3892->3893 3894 40179e 3892->3894 3929 4063e8 lstrcpynW 3893->3929 3930 4063e8 lstrcpynW 3894->3930 3897 40179c 3901 40667c 5 API calls 3897->3901 3898 4017a9 3899 405cbd 3 API calls 3898->3899 3900 4017af lstrcatW 3899->3900 3900->3897 3918 4017bb 3901->3918 3902 40672b 2 API calls 3902->3918 3903 405eb9 2 API calls 3903->3918 3905 4017cd CompareFileTime 3905->3918 3906 40188d 3908 405450 24 API calls 3906->3908 3907 401864 3909 405450 24 API calls 3907->3909 3917 401879 3907->3917 3910 401897 3908->3910 3909->3917 3911 4031d6 44 API calls 3910->3911 3912 4018aa 3911->3912 3913 4018be SetFileTime 3912->3913 3914 4018d0 FindCloseChangeNotification 3912->3914 3913->3914 3916 4018e1 3914->3916 3914->3917 3915 40640a 17 API calls 3915->3918 3919 4018e6 3916->3919 3920 4018f9 3916->3920 3918->3902 3918->3903 3918->3905 3918->3906 3918->3907 3918->3915 3921 4063e8 lstrcpynW 3918->3921 3924 405a4e MessageBoxIndirectW 3918->3924 3928 405ede GetFileAttributesW CreateFileW 3918->3928 3922 40640a 17 API calls 3919->3922 3923 40640a 17 API calls 3920->3923 3921->3918 3925 4018ee lstrcatW 3922->3925 3926 401901 3923->3926 3924->3918 3925->3926 3927 405a4e MessageBoxIndirectW 3926->3927 3927->3917 3928->3918 3929->3897 3930->3898 4326 4027ef 4327 4027f6 4326->4327 4329 402a70 4326->4329 4328 402c1f 17 API calls 4327->4328 4330 4027fd 4328->4330 4331 40280c SetFilePointer 4330->4331 4331->4329 4332 40281c 4331->4332 4334 40632f wsprintfW 4332->4334 4334->4329 4335 401a72 4336 402c1f 17 API calls 4335->4336 4337 401a7b 4336->4337 4338 402c1f 17 API calls 4337->4338 4339 401a20 4338->4339 4340 406af2 4341 406976 4340->4341 4342 4072e1 4341->4342 4343 406a00 GlobalAlloc 4341->4343 4344 4069f7 GlobalFree 4341->4344 4345 406a77 GlobalAlloc 4341->4345 4346 406a6e GlobalFree 4341->4346 4343->4341 4343->4342 4344->4343 4345->4341 4345->4342 4346->4345 4347 401573 4348 401583 ShowWindow 4347->4348 4349 40158c 4347->4349 4348->4349 4350 402ac5 4349->4350 4351 40159a ShowWindow 4349->4351 4351->4350 4352 402df3 4353 402e05 SetTimer 4352->4353 4354 402e1e 4352->4354 4353->4354 4355 402e6c 4354->4355 4356 402e72 MulDiv 4354->4356 4357 402e2c wsprintfW SetWindowTextW SetDlgItemTextW 4356->4357 4357->4355 4359 401cf3 4360 402c1f 17 API calls 4359->4360 4361 401cf9 IsWindow 4360->4361 4362 401a20 4361->4362 4363 4014f5 SetForegroundWindow 4364 402ac5 4363->4364 4365 402576 4366 402c41 17 API calls 4365->4366 4367 40257d 4366->4367 4370 405ede GetFileAttributesW CreateFileW 4367->4370 4369 402589 4370->4369 3954 401b77 3955 401b84 3954->3955 3956 401bc8 3954->3956 3959 4022e4 3955->3959 3965 401b9b 3955->3965 3957 401bf2 GlobalAlloc 3956->3957 3958 401bcd 3956->3958 3960 40640a 17 API calls 3957->3960 3962 401c0d 3958->3962 3975 4063e8 lstrcpynW 3958->3975 3961 40640a 17 API calls 3959->3961 3960->3962 3964 4022f1 3961->3964 3969 405a4e MessageBoxIndirectW 3964->3969 3973 4063e8 lstrcpynW 3965->3973 3966 401bdf GlobalFree 3966->3962 3968 401baa 3974 4063e8 lstrcpynW 3968->3974 3969->3962 3971 401bb9 3976 4063e8 lstrcpynW 3971->3976 3973->3968 3974->3971 3975->3966 3976->3962 3977 4024f8 3978 402c81 17 API calls 3977->3978 3979 402502 3978->3979 3980 402c1f 17 API calls 3979->3980 3981 40250b 3980->3981 3982 402533 RegEnumValueW 3981->3982 3983 402527 RegEnumKeyW 3981->3983 3986 40288b 3981->3986 3984 40254f RegCloseKey 3982->3984 3985 402548 3982->3985 3983->3984 3984->3986 3985->3984 4371 40167b 4372 402c41 17 API calls 4371->4372 4373 401682 4372->4373 4374 402c41 17 API calls 4373->4374 4375 40168b 4374->4375 4376 402c41 17 API calls 4375->4376 4377 401694 MoveFileW 4376->4377 4378 4016a0 4377->4378 4379 4016a7 4377->4379 4381 401423 24 API calls 4378->4381 4380 40672b 2 API calls 4379->4380 4383 402250 4379->4383 4382 4016b6 4380->4382 4381->4383 4382->4383 4384 4061ae 36 API calls 4382->4384 4384->4378 4392 401e7d 4393 402c41 17 API calls 4392->4393 4394 401e83 4393->4394 4395 402c41 17 API calls 4394->4395 4396 401e8c 4395->4396 4397 402c41 17 API calls 4396->4397 4398 401e95 4397->4398 4399 402c41 17 API calls 4398->4399 4400 401e9e 4399->4400 4401 401423 24 API calls 4400->4401 4402 401ea5 4401->4402 4409 405a14 ShellExecuteExW 4402->4409 4404 401ee7 4405 406873 5 API calls 4404->4405 4407 40288b 4404->4407 4406 401f01 CloseHandle 4405->4406 4406->4407 4409->4404 4410 4019ff 4411 402c41 17 API calls 4410->4411 4412 401a06 4411->4412 4413 402c41 17 API calls 4412->4413 4414 401a0f 4413->4414 4415 401a16 lstrcmpiW 4414->4415 4416 401a28 lstrcmpW 4414->4416 4417 401a1c 4415->4417 4416->4417 4418 401000 4419 401037 BeginPaint GetClientRect 4418->4419 4420 40100c DefWindowProcW 4418->4420 4422 4010f3 4419->4422 4423 401179 4420->4423 4424 401073 CreateBrushIndirect FillRect DeleteObject 4422->4424 4425 4010fc 4422->4425 4424->4422 4426 401102 CreateFontIndirectW 4425->4426 4427 401167 EndPaint 4425->4427 4426->4427 4428 401112 6 API calls 4426->4428 4427->4423 4428->4427 4429 401503 4430 40150b 4429->4430 4432 40151e 4429->4432 4431 402c1f 17 API calls 4430->4431 4431->4432 3509 402104 3510 402c41 17 API calls 3509->3510 3511 40210b 3510->3511 3512 402c41 17 API calls 3511->3512 3513 402115 3512->3513 3514 402c41 17 API calls 3513->3514 3515 40211f 3514->3515 3516 402c41 17 API calls 3515->3516 3517 402129 3516->3517 3518 402c41 17 API calls 3517->3518 3520 402133 3518->3520 3519 402172 CoCreateInstance 3524 402191 3519->3524 3520->3519 3521 402c41 17 API calls 3520->3521 3521->3519 3522 401423 24 API calls 3523 402250 3522->3523 3524->3522 3524->3523 3525 402484 3536 402c81 3525->3536 3528 402c41 17 API calls 3529 402497 3528->3529 3530 4024a2 RegQueryValueExW 3529->3530 3535 40288b 3529->3535 3531 4024c8 RegCloseKey 3530->3531 3532 4024c2 3530->3532 3531->3535 3532->3531 3541 40632f wsprintfW 3532->3541 3537 402c41 17 API calls 3536->3537 3538 402c98 3537->3538 3539 406255 RegOpenKeyExW 3538->3539 3540 40248e 3539->3540 3540->3528 3541->3531 3796 401f06 3797 402c41 17 API calls 3796->3797 3798 401f0c 3797->3798 3799 405450 24 API calls 3798->3799 3800 401f16 3799->3800 3801 4059d1 2 API calls 3800->3801 3802 401f1c 3801->3802 3803 401f3f CloseHandle 3802->3803 3807 40288b 3802->3807 3811 406873 WaitForSingleObject 3802->3811 3803->3807 3806 401f31 3808 401f41 3806->3808 3809 401f36 3806->3809 3808->3803 3816 40632f wsprintfW 3809->3816 3812 40688d 3811->3812 3813 40689f GetExitCodeProcess 3812->3813 3814 4067fe 2 API calls 3812->3814 3813->3806 3815 406894 WaitForSingleObject 3814->3815 3815->3812 3816->3803 4433 403e86 4434 403fd9 4433->4434 4435 403e9e 4433->4435 4437 403fea GetDlgItem GetDlgItem 4434->4437 4452 40402a 4434->4452 4435->4434 4436 403eaa 4435->4436 4438 403eb5 SetWindowPos 4436->4438 4439 403ec8 4436->4439 4440 40435f 18 API calls 4437->4440 4438->4439 4442 403ee5 4439->4442 4443 403ecd ShowWindow 4439->4443 4444 404014 SetClassLongW 4440->4444 4441 4043ab SendMessageW 4472 404096 4441->4472 4447 403f07 4442->4447 4448 403eed DestroyWindow 4442->4448 4443->4442 4449 40140b 2 API calls 4444->4449 4445 404084 4445->4441 4446 403fd4 4445->4446 4453 403f0c SetWindowLongW 4447->4453 4454 403f1d 4447->4454 4451 4042e8 4448->4451 4449->4452 4450 401389 2 API calls 4455 40405c 4450->4455 4451->4446 4462 404319 ShowWindow 4451->4462 4452->4445 4452->4450 4453->4446 4459 403f94 4454->4459 4460 403f29 GetDlgItem 4454->4460 4455->4445 4456 404060 SendMessageW 4455->4456 4456->4446 4457 40140b 2 API calls 4457->4472 4458 4042ea DestroyWindow EndDialog 4458->4451 4461 4043c6 8 API calls 4459->4461 4463 403f59 4460->4463 4464 403f3c SendMessageW IsWindowEnabled 4460->4464 4461->4446 4462->4446 4466 403f66 4463->4466 4467 403fad SendMessageW 4463->4467 4468 403f79 4463->4468 4476 403f5e 4463->4476 4464->4446 4464->4463 4465 40640a 17 API calls 4465->4472 4466->4467 4466->4476 4467->4459 4470 403f81 4468->4470 4471 403f96 4468->4471 4473 40140b 2 API calls 4470->4473 4474 40140b 2 API calls 4471->4474 4472->4446 4472->4457 4472->4458 4472->4465 4475 40435f 18 API calls 4472->4475 4477 40435f 18 API calls 4472->4477 4493 40422a DestroyWindow 4472->4493 4473->4476 4474->4476 4475->4472 4476->4459 4502 404338 4476->4502 4478 404111 GetDlgItem 4477->4478 4479 404126 4478->4479 4480 40412e ShowWindow EnableWindow 4478->4480 4479->4480 4505 404381 EnableWindow 4480->4505 4482 404158 EnableWindow 4487 40416c 4482->4487 4483 404171 GetSystemMenu EnableMenuItem SendMessageW 4484 4041a1 SendMessageW 4483->4484 4483->4487 4484->4487 4486 403e67 18 API calls 4486->4487 4487->4483 4487->4486 4506 404394 SendMessageW 4487->4506 4507 4063e8 lstrcpynW 4487->4507 4489 4041d0 lstrlenW 4490 40640a 17 API calls 4489->4490 4491 4041e6 SetWindowTextW 4490->4491 4492 401389 2 API calls 4491->4492 4492->4472 4493->4451 4494 404244 CreateDialogParamW 4493->4494 4494->4451 4495 404277 4494->4495 4496 40435f 18 API calls 4495->4496 4497 404282 GetDlgItem GetWindowRect ScreenToClient SetWindowPos 4496->4497 4498 401389 2 API calls 4497->4498 4499 4042c8 4498->4499 4499->4446 4500 4042d0 ShowWindow 4499->4500 4501 4043ab SendMessageW 4500->4501 4501->4451 4503 404345 SendMessageW 4502->4503 4504 40433f 4502->4504 4503->4459 4504->4503 4505->4482 4506->4487 4507->4489 3817 401389 3819 401390 3817->3819 3818 4013fe 3819->3818 3820 4013cb MulDiv SendMessageW 3819->3820 3820->3819 4508 404809 4509 404819 4508->4509 4510 40483f 4508->4510 4511 40435f 18 API calls 4509->4511 4512 4043c6 8 API calls 4510->4512 4513 404826 SetDlgItemTextW 4511->4513 4514 40484b 4512->4514 4513->4510 3821 40230c 3822 402314 3821->3822 3823 40231a 3821->3823 3824 402c41 17 API calls 3822->3824 3825 402c41 17 API calls 3823->3825 3827 402328 3823->3827 3824->3823 3825->3827 3826 402c41 17 API calls 3829 40233f WritePrivateProfileStringW 3826->3829 3828 402c41 17 API calls 3827->3828 3830 402336 3827->3830 3828->3830 3830->3826 4515 40190c 4516 401943 4515->4516 4517 402c41 17 API calls 4516->4517 4518 401948 4517->4518 4519 405afa 67 API calls 4518->4519 4520 401951 4519->4520 4521 401f8c 4522 402c41 17 API calls 4521->4522 4523 401f93 4522->4523 4524 4067c2 5 API calls 4523->4524 4525 401fa2 4524->4525 4526 401fbe GlobalAlloc 4525->4526 4528 402026 4525->4528 4527 401fd2 4526->4527 4526->4528 4529 4067c2 5 API calls 4527->4529 4530 401fd9 4529->4530 4531 4067c2 5 API calls 4530->4531 4532 401fe3 4531->4532 4532->4528 4536 40632f wsprintfW 4532->4536 4534 402018 4537 40632f wsprintfW 4534->4537 4536->4534 4537->4528 3861 40238e 3862 4023c1 3861->3862 3863 402396 3861->3863 3865 402c41 17 API calls 3862->3865 3864 402c81 17 API calls 3863->3864 3866 40239d 3864->3866 3867 4023c8 3865->3867 3868 4023a7 3866->3868 3872 4023d5 3866->3872 3873 402cff 3867->3873 3870 402c41 17 API calls 3868->3870 3871 4023ae RegDeleteValueW RegCloseKey 3870->3871 3871->3872 3874 402d13 3873->3874 3875 402d0c 3873->3875 3874->3875 3877 402d44 3874->3877 3875->3872 3878 406255 RegOpenKeyExW 3877->3878 3879 402d72 3878->3879 3880 402dec 3879->3880 3882 402d76 3879->3882 3880->3875 3881 402d98 RegEnumKeyW 3881->3882 3883 402daf RegCloseKey 3881->3883 3882->3881 3882->3883 3885 402dd0 RegCloseKey 3882->3885 3887 402d44 6 API calls 3882->3887 3884 4067c2 5 API calls 3883->3884 3886 402dbf 3884->3886 3885->3880 3888 402de0 RegDeleteKeyW 3886->3888 3889 402dc3 3886->3889 3887->3882 3888->3880 3889->3880 4538 40190f 4539 402c41 17 API calls 4538->4539 4540 401916 4539->4540 4541 405a4e MessageBoxIndirectW 4540->4541 4542 40191f 4541->4542 4543 40558f 4544 4055b0 GetDlgItem GetDlgItem GetDlgItem 4543->4544 4545 405739 4543->4545 4588 404394 SendMessageW 4544->4588 4547 405742 GetDlgItem CreateThread CloseHandle 4545->4547 4548 40576a 4545->4548 4547->4548 4550 405795 4548->4550 4551 405781 ShowWindow ShowWindow 4548->4551 4552 4057ba 4548->4552 4549 405620 4555 405627 GetClientRect GetSystemMetrics SendMessageW SendMessageW 4549->4555 4553 4057f5 4550->4553 4557 4057a9 4550->4557 4558 4057cf ShowWindow 4550->4558 4590 404394 SendMessageW 4551->4590 4554 4043c6 8 API calls 4552->4554 4553->4552 4564 405803 SendMessageW 4553->4564 4569 4057c8 4554->4569 4562 405695 4555->4562 4563 405679 SendMessageW SendMessageW 4555->4563 4559 404338 SendMessageW 4557->4559 4560 4057e1 4558->4560 4561 4057ef 4558->4561 4559->4552 4565 405450 24 API calls 4560->4565 4566 404338 SendMessageW 4561->4566 4567 4056a8 4562->4567 4568 40569a SendMessageW 4562->4568 4563->4562 4564->4569 4570 40581c CreatePopupMenu 4564->4570 4565->4561 4566->4553 4572 40435f 18 API calls 4567->4572 4568->4567 4571 40640a 17 API calls 4570->4571 4573 40582c AppendMenuW 4571->4573 4574 4056b8 4572->4574 4577 405849 GetWindowRect 4573->4577 4578 40585c TrackPopupMenu 4573->4578 4575 4056c1 ShowWindow 4574->4575 4576 4056f5 GetDlgItem SendMessageW 4574->4576 4579 4056e4 4575->4579 4580 4056d7 ShowWindow 4575->4580 4576->4569 4582 40571c SendMessageW SendMessageW 4576->4582 4577->4578 4578->4569 4581 405877 4578->4581 4589 404394 SendMessageW 4579->4589 4580->4579 4583 405893 SendMessageW 4581->4583 4582->4569 4583->4583 4584 4058b0 OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 4583->4584 4586 4058d5 SendMessageW 4584->4586 4586->4586 4587 4058fe GlobalUnlock SetClipboardData CloseClipboard 4586->4587 4587->4569 4588->4549 4589->4576 4590->4550 4591 401491 4592 405450 24 API calls 4591->4592 4593 401498 4592->4593 4601 401d14 4602 402c1f 17 API calls 4601->4602 4603 401d1b 4602->4603 4604 402c1f 17 API calls 4603->4604 4605 401d27 GetDlgItem 4604->4605 4606 402592 4605->4606 4607 404495 lstrcpynW lstrlenW 4608 403a96 4609 403aa1 4608->4609 4610 403aa5 4609->4610 4611 403aa8 GlobalAlloc 4609->4611 4611->4610 4612 402598 4613 4025c7 4612->4613 4614 4025ac 4612->4614 4615 4025fb 4613->4615 4616 4025cc 4613->4616 4617 402c1f 17 API calls 4614->4617 4619 402c41 17 API calls 4615->4619 4618 402c41 17 API calls 4616->4618 4625 4025b3 4617->4625 4620 4025d3 WideCharToMultiByte lstrlenA 4618->4620 4621 402602 lstrlenW 4619->4621 4620->4625 4621->4625 4622 40262f 4623 402645 4622->4623 4624 405f90 WriteFile 4622->4624 4624->4623 4625->4622 4625->4623 4626 405fbf 5 API calls 4625->4626 4626->4622 4627 40451e 4628 404536 4627->4628 4634 404650 4627->4634 4635 40435f 18 API calls 4628->4635 4629 4046ba 4630 404784 4629->4630 4631 4046c4 GetDlgItem 4629->4631 4636 4043c6 8 API calls 4630->4636 4632 404745 4631->4632 4633 4046de 4631->4633 4632->4630 4641 404757 4632->4641 4633->4632 4640 404704 SendMessageW LoadCursorW SetCursor 4633->4640 4634->4629 4634->4630 4637 40468b GetDlgItem SendMessageW 4634->4637 4638 40459d 4635->4638 4639 40477f 4636->4639 4660 404381 EnableWindow 4637->4660 4643 40435f 18 API calls 4638->4643 4661 4047cd 4640->4661 4646 40476d 4641->4646 4647 40475d SendMessageW 4641->4647 4644 4045aa CheckDlgButton 4643->4644 4658 404381 EnableWindow 4644->4658 4646->4639 4651 404773 SendMessageW 4646->4651 4647->4646 4648 4046b5 4652 4047a9 SendMessageW 4648->4652 4651->4639 4652->4629 4653 4045c8 GetDlgItem 4659 404394 SendMessageW 4653->4659 4655 4045de SendMessageW 4656 404604 SendMessageW SendMessageW lstrlenW SendMessageW SendMessageW 4655->4656 4657 4045fb GetSysColor 4655->4657 4656->4639 4657->4656 4658->4653 4659->4655 4660->4648 4664 405a14 ShellExecuteExW 4661->4664 4663 404733 LoadCursorW SetCursor 4663->4632 4664->4663 4665 40149e 4666 4022f7 4665->4666 4667 4014ac PostQuitMessage 4665->4667 4667->4666 4668 401c1f 4669 402c1f 17 API calls 4668->4669 4670 401c26 4669->4670 4671 402c1f 17 API calls 4670->4671 4672 401c33 4671->4672 4673 401c48 4672->4673 4674 402c41 17 API calls 4672->4674 4675 401c58 4673->4675 4676 402c41 17 API calls 4673->4676 4674->4673 4677 401c63 4675->4677 4678 401caf 4675->4678 4676->4675 4680 402c1f 17 API calls 4677->4680 4679 402c41 17 API calls 4678->4679 4681 401cb4 4679->4681 4682 401c68 4680->4682 4683 402c41 17 API calls 4681->4683 4684 402c1f 17 API calls 4682->4684 4685 401cbd FindWindowExW 4683->4685 4686 401c74 4684->4686 4689 401cdf 4685->4689 4687 401c81 SendMessageTimeoutW 4686->4687 4688 401c9f SendMessageW 4686->4688 4687->4689 4688->4689 4690 402aa0 SendMessageW 4691 402ac5 4690->4691 4692 402aba InvalidateRect 4690->4692 4692->4691 4693 402821 4694 402827 4693->4694 4695 402ac5 4694->4695 4696 40282f FindClose 4694->4696 4696->4695 4697 4015a3 4698 402c41 17 API calls 4697->4698 4699 4015aa SetFileAttributesW 4698->4699 4700 4015bc 4699->4700 3542 4034a5 SetErrorMode GetVersion 3543 4034e4 3542->3543 3544 4034ea 3542->3544 3545 4067c2 5 API calls 3543->3545 3546 406752 3 API calls 3544->3546 3545->3544 3547 403500 lstrlenA 3546->3547 3547->3544 3548 403510 3547->3548 3549 4067c2 5 API calls 3548->3549 3550 403517 3549->3550 3551 4067c2 5 API calls 3550->3551 3552 40351e 3551->3552 3553 4067c2 5 API calls 3552->3553 3554 40352a #17 OleInitialize SHGetFileInfoW 3553->3554 3632 4063e8 lstrcpynW 3554->3632 3557 403576 GetCommandLineW 3633 4063e8 lstrcpynW 3557->3633 3559 403588 3560 405cea CharNextW 3559->3560 3561 4035ad CharNextW 3560->3561 3562 4036d7 GetTempPathW 3561->3562 3570 4035c6 3561->3570 3634 403474 3562->3634 3564 4036ef 3565 4036f3 GetWindowsDirectoryW lstrcatW 3564->3565 3566 403749 DeleteFileW 3564->3566 3567 403474 12 API calls 3565->3567 3644 402f30 GetTickCount GetModuleFileNameW 3566->3644 3571 40370f 3567->3571 3568 405cea CharNextW 3568->3570 3570->3568 3578 4036c2 3570->3578 3579 4036c0 3570->3579 3571->3566 3573 403713 GetTempPathW lstrcatW SetEnvironmentVariableW SetEnvironmentVariableW 3571->3573 3572 40375d 3574 403814 ExitProcess OleUninitialize 3572->3574 3580 403800 3572->3580 3586 405cea CharNextW 3572->3586 3577 403474 12 API calls 3573->3577 3575 40394a 3574->3575 3576 40382a 3574->3576 3582 403952 GetCurrentProcess OpenProcessToken 3575->3582 3583 4039ce ExitProcess 3575->3583 3734 405a4e 3576->3734 3584 403741 3577->3584 3731 4063e8 lstrcpynW 3578->3731 3579->3562 3674 403ad8 3580->3674 3590 40396a LookupPrivilegeValueW AdjustTokenPrivileges 3582->3590 3591 40399e 3582->3591 3584->3566 3584->3574 3597 40377c 3586->3597 3590->3591 3593 4067c2 5 API calls 3591->3593 3596 4039a5 3593->3596 3594 403840 3598 4059b9 5 API calls 3594->3598 3595 4037da 3599 405dc5 18 API calls 3595->3599 3600 4039ba ExitWindowsEx 3596->3600 3603 4039c7 3596->3603 3597->3594 3597->3595 3601 403845 lstrcatW 3598->3601 3602 4037e6 3599->3602 3600->3583 3600->3603 3604 403861 lstrcatW lstrcmpiW 3601->3604 3605 403856 lstrcatW 3601->3605 3602->3574 3732 4063e8 lstrcpynW 3602->3732 3743 40140b 3603->3743 3604->3574 3607 40387d 3604->3607 3605->3604 3609 403882 3607->3609 3610 403889 3607->3610 3612 40591f 4 API calls 3609->3612 3614 40599c 2 API calls 3610->3614 3611 4037f5 3733 4063e8 lstrcpynW 3611->3733 3615 403887 3612->3615 3616 40388e SetCurrentDirectoryW 3614->3616 3615->3616 3617 4038a9 3616->3617 3618 40389e 3616->3618 3739 4063e8 lstrcpynW 3617->3739 3738 4063e8 lstrcpynW 3618->3738 3621 40640a 17 API calls 3622 4038e8 DeleteFileW 3621->3622 3623 4038f5 CopyFileW 3622->3623 3629 4038b7 3622->3629 3623->3629 3624 40393e 3625 4061ae 36 API calls 3624->3625 3627 403945 3625->3627 3626 4061ae 36 API calls 3626->3629 3627->3574 3628 40640a 17 API calls 3628->3629 3629->3621 3629->3624 3629->3626 3629->3628 3631 403929 CloseHandle 3629->3631 3740 4059d1 CreateProcessW 3629->3740 3631->3629 3632->3557 3633->3559 3635 40667c 5 API calls 3634->3635 3636 403480 3635->3636 3637 40348a 3636->3637 3638 405cbd 3 API calls 3636->3638 3637->3564 3639 403492 3638->3639 3640 40599c 2 API calls 3639->3640 3641 403498 3640->3641 3746 405f0d 3641->3746 3750 405ede GetFileAttributesW CreateFileW 3644->3750 3646 402f73 3673 402f80 3646->3673 3751 4063e8 lstrcpynW 3646->3751 3648 402f96 3649 405d09 2 API calls 3648->3649 3650 402f9c 3649->3650 3752 4063e8 lstrcpynW 3650->3752 3652 402fa7 GetFileSize 3653 4030a8 3652->3653 3657 402fbe 3652->3657 3654 402e8e 32 API calls 3653->3654 3656 4030af 3654->3656 3655 403447 ReadFile 3655->3657 3659 4030eb GlobalAlloc 3656->3659 3656->3673 3754 40345d SetFilePointer 3656->3754 3657->3653 3657->3655 3658 403143 3657->3658 3665 402e8e 32 API calls 3657->3665 3657->3673 3662 402e8e 32 API calls 3658->3662 3661 403102 3659->3661 3666 405f0d 2 API calls 3661->3666 3662->3673 3663 4030cc 3664 403447 ReadFile 3663->3664 3668 4030d7 3664->3668 3665->3657 3667 403113 CreateFileW 3666->3667 3669 40314d 3667->3669 3667->3673 3668->3659 3668->3673 3753 40345d SetFilePointer 3669->3753 3671 40315b 3672 4031d6 44 API calls 3671->3672 3672->3673 3673->3572 3673->3673 3675 4067c2 5 API calls 3674->3675 3676 403aec 3675->3676 3677 403af2 3676->3677 3678 403b04 3676->3678 3763 40632f wsprintfW 3677->3763 3679 4062b6 3 API calls 3678->3679 3680 403b34 3679->3680 3682 403b53 lstrcatW 3680->3682 3684 4062b6 3 API calls 3680->3684 3683 403b02 3682->3683 3755 403dae 3683->3755 3684->3682 3687 405dc5 18 API calls 3688 403b85 3687->3688 3689 403c19 3688->3689 3691 4062b6 3 API calls 3688->3691 3690 405dc5 18 API calls 3689->3690 3692 403c1f 3690->3692 3693 403bb7 3691->3693 3694 403c2f LoadImageW 3692->3694 3695 40640a 17 API calls 3692->3695 3693->3689 3698 403bd8 lstrlenW 3693->3698 3702 405cea CharNextW 3693->3702 3696 403cd5 3694->3696 3697 403c56 RegisterClassW 3694->3697 3695->3694 3701 40140b 2 API calls 3696->3701 3699 403810 3697->3699 3700 403c8c SystemParametersInfoW CreateWindowExW 3697->3700 3703 403be6 lstrcmpiW 3698->3703 3704 403c0c 3698->3704 3699->3574 3700->3696 3705 403cdb 3701->3705 3707 403bd5 3702->3707 3703->3704 3708 403bf6 GetFileAttributesW 3703->3708 3706 405cbd 3 API calls 3704->3706 3705->3699 3709 403dae 18 API calls 3705->3709 3710 403c12 3706->3710 3707->3698 3711 403c02 3708->3711 3712 403cec 3709->3712 3764 4063e8 lstrcpynW 3710->3764 3711->3704 3714 405d09 2 API calls 3711->3714 3715 403cf8 ShowWindow 3712->3715 3716 403d7b 3712->3716 3714->3704 3717 406752 3 API calls 3715->3717 3765 405523 OleInitialize 3716->3765 3720 403d10 3717->3720 3719 403d81 3721 403d85 3719->3721 3722 403d9d 3719->3722 3723 403d1e GetClassInfoW 3720->3723 3725 406752 3 API calls 3720->3725 3721->3699 3728 40140b 2 API calls 3721->3728 3724 40140b 2 API calls 3722->3724 3726 403d32 GetClassInfoW RegisterClassW 3723->3726 3727 403d48 DialogBoxParamW 3723->3727 3724->3699 3725->3723 3726->3727 3729 40140b 2 API calls 3727->3729 3728->3699 3730 403d70 3729->3730 3730->3699 3731->3579 3732->3611 3733->3580 3735 405a63 3734->3735 3736 403838 ExitProcess 3735->3736 3737 405a77 MessageBoxIndirectW 3735->3737 3737->3736 3738->3617 3739->3629 3741 405a10 3740->3741 3742 405a04 CloseHandle 3740->3742 3741->3629 3742->3741 3744 401389 2 API calls 3743->3744 3745 401420 3744->3745 3745->3583 3747 405f1a GetTickCount GetTempFileNameW 3746->3747 3748 405f50 3747->3748 3749 4034a3 3747->3749 3748->3747 3748->3749 3749->3564 3750->3646 3751->3648 3752->3652 3753->3671 3754->3663 3756 403dc2 3755->3756 3772 40632f wsprintfW 3756->3772 3758 403e33 3773 403e67 3758->3773 3760 403b63 3760->3687 3761 403e38 3761->3760 3762 40640a 17 API calls 3761->3762 3762->3761 3763->3683 3764->3689 3776 4043ab 3765->3776 3767 405546 3771 40556d 3767->3771 3779 401389 3767->3779 3768 4043ab SendMessageW 3769 40557f OleUninitialize 3768->3769 3769->3719 3771->3768 3772->3758 3774 40640a 17 API calls 3773->3774 3775 403e75 SetWindowTextW 3774->3775 3775->3761 3777 4043c3 3776->3777 3778 4043b4 SendMessageW 3776->3778 3777->3767 3778->3777 3781 401390 3779->3781 3780 4013fe 3780->3767 3781->3780 3782 4013cb MulDiv SendMessageW 3781->3782 3782->3781 4701 404ba6 4702 404bd2 4701->4702 4703 404bb6 4701->4703 4705 404c05 4702->4705 4706 404bd8 SHGetPathFromIDListW 4702->4706 4712 405a32 GetDlgItemTextW 4703->4712 4708 404bef SendMessageW 4706->4708 4709 404be8 4706->4709 4707 404bc3 SendMessageW 4707->4702 4708->4705 4710 40140b 2 API calls 4709->4710 4710->4708 4712->4707 4727 4029a8 4728 402c1f 17 API calls 4727->4728 4729 4029ae 4728->4729 4730 4029d5 4729->4730 4731 4029ee 4729->4731 4735 40288b 4729->4735 4732 4029da 4730->4732 4740 4029eb 4730->4740 4733 402a08 4731->4733 4734 4029f8 4731->4734 4741 4063e8 lstrcpynW 4732->4741 4737 40640a 17 API calls 4733->4737 4736 402c1f 17 API calls 4734->4736 4736->4740 4737->4740 4740->4735 4742 40632f wsprintfW 4740->4742 4741->4735 4742->4735 3831 4028ad 3832 402c41 17 API calls 3831->3832 3833 4028bb 3832->3833 3834 4028d1 3833->3834 3836 402c41 17 API calls 3833->3836 3835 405eb9 2 API calls 3834->3835 3837 4028d7 3835->3837 3836->3834 3859 405ede GetFileAttributesW CreateFileW 3837->3859 3839 4028e4 3840 4028f0 GlobalAlloc 3839->3840 3841 402987 3839->3841 3842 402909 3840->3842 3843 40297e CloseHandle 3840->3843 3844 4029a2 3841->3844 3845 40298f DeleteFileW 3841->3845 3860 40345d SetFilePointer 3842->3860 3843->3841 3845->3844 3847 40290f 3848 403447 ReadFile 3847->3848 3849 402918 GlobalAlloc 3848->3849 3850 402928 3849->3850 3851 40295c 3849->3851 3853 4031d6 44 API calls 3850->3853 3852 405f90 WriteFile 3851->3852 3854 402968 GlobalFree 3852->3854 3858 402935 3853->3858 3855 4031d6 44 API calls 3854->3855 3857 40297b 3855->3857 3856 402953 GlobalFree 3856->3851 3857->3843 3858->3856 3859->3839 3860->3847 4750 401a30 4751 402c41 17 API calls 4750->4751 4752 401a39 ExpandEnvironmentStringsW 4751->4752 4753 401a60 4752->4753 4754 401a4d 4752->4754 4754->4753 4755 401a52 lstrcmpW 4754->4755 4755->4753 3931 402032 3932 402044 3931->3932 3933 4020f6 3931->3933 3934 402c41 17 API calls 3932->3934 3935 401423 24 API calls 3933->3935 3936 40204b 3934->3936 3942 402250 3935->3942 3937 402c41 17 API calls 3936->3937 3938 402054 3937->3938 3939 40206a LoadLibraryExW 3938->3939 3940 40205c GetModuleHandleW 3938->3940 3939->3933 3941 40207b 3939->3941 3940->3939 3940->3941 3951 406831 WideCharToMultiByte 3941->3951 3945 4020c5 3947 405450 24 API calls 3945->3947 3946 40208c 3948 401423 24 API calls 3946->3948 3949 40209c 3946->3949 3947->3949 3948->3949 3949->3942 3950 4020e8 FreeLibrary 3949->3950 3950->3942 3952 40685b GetProcAddress 3951->3952 3953 402086 3951->3953 3952->3953 3953->3945 3953->3946 4761 401735 4762 402c41 17 API calls 4761->4762 4763 40173c SearchPathW 4762->4763 4764 401757 4763->4764 4765 402a35 4766 402c1f 17 API calls 4765->4766 4767 402a3b 4766->4767 4768 402a72 4767->4768 4770 40288b 4767->4770 4771 402a4d 4767->4771 4769 40640a 17 API calls 4768->4769 4768->4770 4769->4770 4771->4770 4773 40632f wsprintfW 4771->4773 4773->4770 4774 4014b8 4775 4014be 4774->4775 4776 401389 2 API calls 4775->4776 4777 4014c6 4776->4777 4778 401db9 GetDC 4779 402c1f 17 API calls 4778->4779 4780 401dcb GetDeviceCaps MulDiv ReleaseDC 4779->4780 4781 402c1f 17 API calls 4780->4781 4782 401dfc 4781->4782 4783 40640a 17 API calls 4782->4783 4784 401e39 CreateFontIndirectW 4783->4784 4785 402592 4784->4785 4786 40283b 4787 402843 4786->4787 4788 402847 FindNextFileW 4787->4788 4791 402859 4787->4791 4789 4028a0 4788->4789 4788->4791 4792 4063e8 lstrcpynW 4789->4792 4792->4791

                                                                                                                                                                Executed Functions

                                                                                                                                                                Function 004034A5 Relevance: 89.7, APIs: 33, Strings: 18, Instructions: 410stringfilecomCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 0 4034a5-4034e2 SetErrorMode GetVersion 1 4034e4-4034ec call 4067c2 0->1 2 4034f5 0->2 1->2 8 4034ee 1->8 4 4034fa-40350e call 406752 lstrlenA 2->4 9 403510-40352c call 4067c2 * 3 4->9 8->2 16 40353d-40359c #17 OleInitialize SHGetFileInfoW call 4063e8 GetCommandLineW call 4063e8 9->16 17 40352e-403534 9->17 24 4035a6-4035c0 call 405cea CharNextW 16->24 25 40359e-4035a5 16->25 17->16 21 403536 17->21 21->16 28 4035c6-4035cc 24->28 29 4036d7-4036f1 GetTempPathW call 403474 24->29 25->24 30 4035d5-4035d9 28->30 31 4035ce-4035d3 28->31 36 4036f3-403711 GetWindowsDirectoryW lstrcatW call 403474 29->36 37 403749-403763 DeleteFileW call 402f30 29->37 34 4035e0-4035e4 30->34 35 4035db-4035df 30->35 31->30 31->31 38 4036a3-4036b0 call 405cea 34->38 39 4035ea-4035f0 34->39 35->34 36->37 53 403713-403743 GetTempPathW lstrcatW SetEnvironmentVariableW * 2 call 403474 36->53 57 403814-403824 ExitProcess OleUninitialize 37->57 58 403769-40376f 37->58 55 4036b2-4036b3 38->55 56 4036b4-4036ba 38->56 43 4035f2-4035fa 39->43 44 40360b-403644 39->44 48 403601 43->48 49 4035fc-4035ff 43->49 50 403661-40369b 44->50 51 403646-40364b 44->51 48->44 49->44 49->48 50->38 54 40369d-4036a1 50->54 51->50 52 40364d-403655 51->52 61 403657-40365a 52->61 62 40365c 52->62 53->37 53->57 54->38 64 4036c2-4036d0 call 4063e8 54->64 55->56 56->28 65 4036c0 56->65 59 40394a-403950 57->59 60 40382a-40383a call 405a4e ExitProcess 57->60 66 403804-40380b call 403ad8 58->66 67 403775-403780 call 405cea 58->67 69 403952-403968 GetCurrentProcess OpenProcessToken 59->69 70 4039ce-4039d6 59->70 61->50 61->62 62->50 72 4036d5 64->72 65->72 82 403810 66->82 84 403782-4037b7 67->84 85 4037ce-4037d8 67->85 79 40396a-403998 LookupPrivilegeValueW AdjustTokenPrivileges 69->79 80 40399e-4039ac call 4067c2 69->80 76 4039d8 70->76 77 4039dc-4039e0 ExitProcess 70->77 72->29 76->77 79->80 94 4039ba-4039c5 ExitWindowsEx 80->94 95 4039ae-4039b8 80->95 82->57 89 4037b9-4037bd 84->89 86 403840-403854 call 4059b9 lstrcatW 85->86 87 4037da-4037e8 call 405dc5 85->87 100 403861-40387b lstrcatW lstrcmpiW 86->100 101 403856-40385c lstrcatW 86->101 87->57 102 4037ea-403800 call 4063e8 * 2 87->102 90 4037c6-4037ca 89->90 91 4037bf-4037c4 89->91 90->89 96 4037cc 90->96 91->90 91->96 94->70 99 4039c7-4039c9 call 40140b 94->99 95->94 95->99 96->85 99->70 100->57 105 40387d-403880 100->105 101->100 102->66 107 403882-403887 call 40591f 105->107 108 403889 call 40599c 105->108 115 40388e-40389c SetCurrentDirectoryW 107->115 108->115 116 4038a9-4038d2 call 4063e8 115->116 117 40389e-4038a4 call 4063e8 115->117 121 4038d7-4038f3 call 40640a DeleteFileW 116->121 117->116 124 403934-40393c 121->124 125 4038f5-403905 CopyFileW 121->125 124->121 126 40393e-403945 call 4061ae 124->126 125->124 127 403907-403927 call 4061ae call 40640a call 4059d1 125->127 126->57 127->124 136 403929-403930 CloseHandle 127->136 136->124
                                                                                                                                                                APIs
                                                                                                                                                                • SetErrorMode.KERNELBASE ref: 004034C8
                                                                                                                                                                • GetVersion.KERNEL32 ref: 004034CE
                                                                                                                                                                • lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403501
                                                                                                                                                                • #17.COMCTL32(?,00000006,00000008,0000000A), ref: 0040353E
                                                                                                                                                                • OleInitialize.OLE32(00000000), ref: 00403545
                                                                                                                                                                • SHGetFileInfoW.SHELL32(004216E8,00000000,?,000002B4,00000000), ref: 00403561
                                                                                                                                                                • GetCommandLineW.KERNEL32(00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 00403576
                                                                                                                                                                • CharNextW.USER32(00000000,"C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe" /S,00000020,"C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe" /S,00000000,?,00000006,00000008,0000000A), ref: 004035AE
                                                                                                                                                                  • Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
                                                                                                                                                                  • Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF
                                                                                                                                                                • GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 004036E8
                                                                                                                                                                • GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000006,00000008,0000000A), ref: 004036F9
                                                                                                                                                                • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403705
                                                                                                                                                                • GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 00403719
                                                                                                                                                                • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 00403721
                                                                                                                                                                • SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 00403732
                                                                                                                                                                • SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 0040373A
                                                                                                                                                                • DeleteFileW.KERNELBASE(1033,?,00000006,00000008,0000000A), ref: 0040374E
                                                                                                                                                                  • Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5
                                                                                                                                                                • ExitProcess.KERNEL32(00000006,?,00000006,00000008,0000000A), ref: 00403814
                                                                                                                                                                • OleUninitialize.OLE32(00000006,?,00000006,00000008,0000000A), ref: 00403819
                                                                                                                                                                • ExitProcess.KERNEL32 ref: 0040383A
                                                                                                                                                                • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu), ref: 0040384D
                                                                                                                                                                • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A328), ref: 0040385C
                                                                                                                                                                • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp), ref: 00403867
                                                                                                                                                                • lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe" /S,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403873
                                                                                                                                                                • SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 0040388F
                                                                                                                                                                • DeleteFileW.KERNEL32(00420EE8,00420EE8,?,0042B000,00000008,?,00000006,00000008,0000000A), ref: 004038E9
                                                                                                                                                                • CopyFileW.KERNEL32(C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe,00420EE8,00000001,?,00000006,00000008,0000000A), ref: 004038FD
                                                                                                                                                                • CloseHandle.KERNEL32(00000000,00420EE8,00420EE8,?,00420EE8,00000000,?,00000006,00000008,0000000A), ref: 0040392A
                                                                                                                                                                • GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 00403959
                                                                                                                                                                • OpenProcessToken.ADVAPI32(00000000), ref: 00403960
                                                                                                                                                                • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403975
                                                                                                                                                                • AdjustTokenPrivileges.ADVAPI32 ref: 00403998
                                                                                                                                                                • ExitWindowsEx.USER32(00000002,80040002), ref: 004039BD
                                                                                                                                                                • ExitProcess.KERNEL32 ref: 004039E0
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Processlstrcat$ExitFile$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
                                                                                                                                                                • String ID: "C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe" /S$.tmp$1033$C:\Program Files\BitComet$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp$C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe$C:\Users\user\AppData\Local\Temp\nscA1E4.tmp$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
                                                                                                                                                                • API String ID: 424501083-432266284
                                                                                                                                                                • Opcode ID: 7747744a0c61db5a6003fa52f6a5a01c2ea0b04c35aa2de3c18c65830cbca02b
                                                                                                                                                                • Instruction ID: dafc1af32610b20ef8647c0cf6a3faef20d76686829591872cbc6ab955e55f97
                                                                                                                                                                • Opcode Fuzzy Hash: 7747744a0c61db5a6003fa52f6a5a01c2ea0b04c35aa2de3c18c65830cbca02b
                                                                                                                                                                • Instruction Fuzzy Hash: 4DD1F571600310ABE7206F759D49A3B3AECEB4070AF50443FF981B62D2DB7D8956876E
                                                                                                                                                                Function 00405AFA Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148filestringCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 282 405afa-405b20 call 405dc5 285 405b22-405b34 DeleteFileW 282->285 286 405b39-405b40 282->286 289 405cb6-405cba 285->289 287 405b42-405b44 286->287 288 405b53-405b63 call 4063e8 286->288 290 405c64-405c69 287->290 291 405b4a-405b4d 287->291 295 405b72-405b73 call 405d09 288->295 296 405b65-405b70 lstrcatW 288->296 290->289 294 405c6b-405c6e 290->294 291->288 291->290 297 405c70-405c76 294->297 298 405c78-405c80 call 40672b 294->298 299 405b78-405b7c 295->299 296->299 297->289 298->289 306 405c82-405c96 call 405cbd call 405ab2 298->306 302 405b88-405b8e lstrcatW 299->302 303 405b7e-405b86 299->303 305 405b93-405baf lstrlenW FindFirstFileW 302->305 303->302 303->305 307 405bb5-405bbd 305->307 308 405c59-405c5d 305->308 322 405c98-405c9b 306->322 323 405cae-405cb1 call 405450 306->323 311 405bdd-405bf1 call 4063e8 307->311 312 405bbf-405bc7 307->312 308->290 310 405c5f 308->310 310->290 324 405bf3-405bfb 311->324 325 405c08-405c13 call 405ab2 311->325 316 405bc9-405bd1 312->316 317 405c3c-405c4c FindNextFileW 312->317 316->311 321 405bd3-405bdb 316->321 317->307 320 405c52-405c53 FindClose 317->320 320->308 321->311 321->317 322->297 326 405c9d-405cac call 405450 call 4061ae 322->326 323->289 324->317 327 405bfd-405c06 call 405afa 324->327 335 405c34-405c37 call 405450 325->335 336 405c15-405c18 325->336 326->289 327->317 335->317 339 405c1a-405c2a call 405450 call 4061ae 336->339 340 405c2c-405c32 336->340 339->317 340->317
                                                                                                                                                                APIs
                                                                                                                                                                • DeleteFileW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,74DF2EE0,00000000), ref: 00405B23
                                                                                                                                                                • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\*.*,\*.*), ref: 00405B6B
                                                                                                                                                                • lstrcatW.KERNEL32(?,0040A014), ref: 00405B8E
                                                                                                                                                                • lstrlenW.KERNEL32(?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\*.*,?,?,C:\Users\user\AppData\Local\Temp\,74DF2EE0,00000000), ref: 00405B94
                                                                                                                                                                • FindFirstFileW.KERNELBASE(C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\*.*,?,?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\*.*,?,?,C:\Users\user\AppData\Local\Temp\,74DF2EE0,00000000), ref: 00405BA4
                                                                                                                                                                • FindNextFileW.KERNELBASE(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405C44
                                                                                                                                                                • FindClose.KERNEL32(00000000), ref: 00405C53
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
                                                                                                                                                                • String ID: "C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe" /S$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\*.*$\*.*
                                                                                                                                                                • API String ID: 2035342205-1833572022
                                                                                                                                                                • Opcode ID: 94aee6277fb60bc187ec105b0c3c889327325094ff3d5538513028a918914a00
                                                                                                                                                                • Instruction ID: 490a569b50011677cd34e026f6ab1003dec3a9533e419df12a6715eb2ed0bc70
                                                                                                                                                                • Opcode Fuzzy Hash: 94aee6277fb60bc187ec105b0c3c889327325094ff3d5538513028a918914a00
                                                                                                                                                                • Instruction Fuzzy Hash: 0541BF30805B18A6EB31AB618D89BAF7678EF41718F10817BF801711D2D77C59C29EAE
                                                                                                                                                                Function 00406AF2 Relevance: 5.4, APIs: 4, Instructions: 382COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 546 406af2-406af7 547 406b68-406b86 546->547 548 406af9-406b28 546->548 551 40715e-407173 547->551 549 406b2a-406b2d 548->549 550 406b2f-406b33 548->550 554 406b3f-406b42 549->554 555 406b35-406b39 550->555 556 406b3b 550->556 552 407175-40718b 551->552 553 40718d-4071a3 551->553 557 4071a6-4071ad 552->557 553->557 558 406b60-406b63 554->558 559 406b44-406b4d 554->559 555->554 556->554 560 4071d4-4071e0 557->560 561 4071af-4071b3 557->561 564 406d35-406d53 558->564 562 406b52-406b5e 559->562 563 406b4f 559->563 574 406976-40697f 560->574 567 407362-40736c 561->567 568 4071b9-4071d1 561->568 570 406bc8-406bf6 562->570 563->562 565 406d55-406d69 564->565 566 406d6b-406d7d 564->566 573 406d80-406d8a 565->573 566->573 575 407378-40738b 567->575 568->560 571 406c12-406c2c 570->571 572 406bf8-406c10 570->572 577 406c2f-406c39 571->577 572->577 578 406d8c 573->578 579 406d2d-406d33 573->579 580 406985 574->580 581 40738d 574->581 576 407390-407394 575->576 583 406bb0-406bb6 577->583 584 406c3f 577->584 585 406d08-406d0c 578->585 586 406e9d-406eaa 578->586 579->564 582 406cd1-406cdb 579->582 587 406a31-406a35 580->587 588 406aa1-406aa5 580->588 589 40698c-406990 580->589 590 406acc-406aed 580->590 581->576 593 407320-40732a 582->593 594 406ce1-406d03 582->594 595 406c69-406c6f 583->595 596 406bbc-406bc2 583->596 603 406b95-406bad 584->603 604 4072fc-407306 584->604 597 406d12-406d2a 585->597 598 407314-40731e 585->598 586->574 600 4072e1-4072eb 587->600 601 406a3b-406a54 587->601 591 4072f0-4072fa 588->591 592 406aab-406abf 588->592 589->575 602 406996-4069a3 589->602 590->551 591->575 606 406ac2-406aca 592->606 593->575 594->586 607 406ccd 595->607 609 406c71-406c8f 595->609 596->570 596->607 597->579 598->575 600->575 608 406a57-406a5b 601->608 602->581 605 4069a9-4069ef 602->605 603->583 604->575 610 4069f1-4069f5 605->610 611 406a17-406a19 605->611 606->588 606->590 607->582 608->587 612 406a5d-406a63 608->612 613 406c91-406ca5 609->613 614 406ca7-406cb9 609->614 615 406a00-406a0e GlobalAlloc 610->615 616 4069f7-4069fa GlobalFree 610->616 617 406a27-406a2f 611->617 618 406a1b-406a25 611->618 619 406a65-406a6c 612->619 620 406a8d-406a9f 612->620 621 406cbc-406cc6 613->621 614->621 615->581 622 406a14 615->622 616->615 617->608 618->617 618->618 623 406a77-406a87 GlobalAlloc 619->623 624 406a6e-406a71 GlobalFree 619->624 620->606 621->595 625 406cc8 621->625 622->611 623->581 623->620 624->623 627 407308-407312 625->627 628 406c4e-406c66 625->628 627->575 628->595
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
                                                                                                                                                                • Instruction ID: 8a3521d6a9ab1c5b5eb45e3d7957e6eefdd785676f1866d9874d60d9aff9e69c
                                                                                                                                                                • Opcode Fuzzy Hash: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
                                                                                                                                                                • Instruction Fuzzy Hash: 1CF16770D04229CBDF18CFA8C8946ADBBB0FF45305F25816ED856BB281D7386A86DF45
                                                                                                                                                                Function 0040672B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • FindFirstFileW.KERNELBASE(?,00426778,00425F30,00405E0E,00425F30,00425F30,00000000,00425F30,00425F30,?,?,74DF2EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,74DF2EE0), ref: 00406736
                                                                                                                                                                • FindClose.KERNEL32(00000000), ref: 00406742
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Find$CloseFileFirst
                                                                                                                                                                • String ID: xgB
                                                                                                                                                                • API String ID: 2295610775-399326502
                                                                                                                                                                • Opcode ID: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
                                                                                                                                                                • Instruction ID: 964bfaba6fe47efa91ae3b9d04416f3a0311ddb8c2b0a677c8b566ff70b98767
                                                                                                                                                                • Opcode Fuzzy Hash: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
                                                                                                                                                                • Instruction Fuzzy Hash: 08D012315150205BC2011738BD4C85B7A589F553357228B37B866F61E0C7348C62869C
                                                                                                                                                                Function 00402104 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CoCreateInstance.OLE32(004084DC,?,00000001,004084CC,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402183
                                                                                                                                                                Strings
                                                                                                                                                                • C:\Users\user\AppData\Local\Temp\nscA1E4.tmp, xrefs: 004021C3
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateInstance
                                                                                                                                                                • String ID: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp
                                                                                                                                                                • API String ID: 542301482-3719291795
                                                                                                                                                                • Opcode ID: 4f2286ed38648dcc2c47485c3b8c03fd85972866aeeba554557880fa94d5da5d
                                                                                                                                                                • Instruction ID: e2e3704c815c40c35bbcee670b9089186c45407539ca1009a8039cbe375c7a13
                                                                                                                                                                • Opcode Fuzzy Hash: 4f2286ed38648dcc2c47485c3b8c03fd85972866aeeba554557880fa94d5da5d
                                                                                                                                                                • Instruction Fuzzy Hash: 03414A71A00208AFCF04DFE4C988A9D7BB5FF48314B24457AF915EB2E0DBB99981CB54
                                                                                                                                                                Function 00403AD8 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215stringregistryCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 137 403ad8-403af0 call 4067c2 140 403af2-403b02 call 40632f 137->140 141 403b04-403b3b call 4062b6 137->141 150 403b5e-403b87 call 403dae call 405dc5 140->150 146 403b53-403b59 lstrcatW 141->146 147 403b3d-403b4e call 4062b6 141->147 146->150 147->146 155 403c19-403c21 call 405dc5 150->155 156 403b8d-403b92 150->156 162 403c23-403c2a call 40640a 155->162 163 403c2f-403c54 LoadImageW 155->163 156->155 157 403b98-403bc0 call 4062b6 156->157 157->155 164 403bc2-403bc6 157->164 162->163 166 403cd5-403cdd call 40140b 163->166 167 403c56-403c86 RegisterClassW 163->167 168 403bd8-403be4 lstrlenW 164->168 169 403bc8-403bd5 call 405cea 164->169 181 403ce7-403cf2 call 403dae 166->181 182 403cdf-403ce2 166->182 170 403da4 167->170 171 403c8c-403cd0 SystemParametersInfoW CreateWindowExW 167->171 175 403be6-403bf4 lstrcmpiW 168->175 176 403c0c-403c14 call 405cbd call 4063e8 168->176 169->168 174 403da6-403dad 170->174 171->166 175->176 180 403bf6-403c00 GetFileAttributesW 175->180 176->155 185 403c02-403c04 180->185 186 403c06-403c07 call 405d09 180->186 190 403cf8-403d12 ShowWindow call 406752 181->190 191 403d7b-403d83 call 405523 181->191 182->174 185->176 185->186 186->176 198 403d14-403d19 call 406752 190->198 199 403d1e-403d30 GetClassInfoW 190->199 196 403d85-403d8b 191->196 197 403d9d-403d9f call 40140b 191->197 196->182 200 403d91-403d98 call 40140b 196->200 197->170 198->199 203 403d32-403d42 GetClassInfoW RegisterClassW 199->203 204 403d48-403d79 DialogBoxParamW call 40140b call 403a28 199->204 200->182 203->204 204->174
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
                                                                                                                                                                  • Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF
                                                                                                                                                                • lstrcatW.KERNEL32(1033,00423728), ref: 00403B59
                                                                                                                                                                • lstrlenW.KERNEL32("C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe" https://www.bitcomet.com/client/install-stats/?l=en_us&file=Bit,?,?,?,"C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe" https://www.bitcomet.com/client/install-stats/?l=en_us&file=Bit,00000000,C:\Program Files\BitComet,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,C:\Users\user\AppData\Local\Temp\), ref: 00403BD9
                                                                                                                                                                • lstrcmpiW.KERNEL32(?,.exe,"C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe" https://www.bitcomet.com/client/install-stats/?l=en_us&file=Bit,?,?,?,"C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe" https://www.bitcomet.com/client/install-stats/?l=en_us&file=Bit,00000000,C:\Program Files\BitComet,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000), ref: 00403BEC
                                                                                                                                                                • GetFileAttributesW.KERNEL32("C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe" https://www.bitcomet.com/client/install-stats/?l=en_us&file=Bit), ref: 00403BF7
                                                                                                                                                                • LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Program Files\BitComet), ref: 00403C40
                                                                                                                                                                  • Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C
                                                                                                                                                                • RegisterClassW.USER32(004291E0), ref: 00403C7D
                                                                                                                                                                • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403C95
                                                                                                                                                                • CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403CCA
                                                                                                                                                                • ShowWindow.USER32(00000005,00000000), ref: 00403D00
                                                                                                                                                                • GetClassInfoW.USER32(00000000,RichEdit20W,004291E0), ref: 00403D2C
                                                                                                                                                                • GetClassInfoW.USER32(00000000,RichEdit,004291E0), ref: 00403D39
                                                                                                                                                                • RegisterClassW.USER32(004291E0), ref: 00403D42
                                                                                                                                                                • DialogBoxParamW.USER32(?,00000000,00403E86,00000000), ref: 00403D61
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
                                                                                                                                                                • String ID: "C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe" /S$"C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe" https://www.bitcomet.com/client/install-stats/?l=en_us&file=Bit$(7B$.DEFAULT\Control Panel\International$.exe$1033$C:\Program Files\BitComet$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
                                                                                                                                                                • API String ID: 1975747703-858030965
                                                                                                                                                                • Opcode ID: e176ff3262b2d1e72d3b52b43e3223aecab7214ec1d4ef21ed1b613fd77ea834
                                                                                                                                                                • Instruction ID: d9d584b045f25ca5441dadad30e0f8e7905dec5efd4dcfd01c713d0f2754c543
                                                                                                                                                                • Opcode Fuzzy Hash: e176ff3262b2d1e72d3b52b43e3223aecab7214ec1d4ef21ed1b613fd77ea834
                                                                                                                                                                • Instruction Fuzzy Hash: 6761C470204601BBE320AF669E45F2B3A7CEB84749F40447FF945B62E2DB7D9912C62D
                                                                                                                                                                Function 00402F30 Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203memoryCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 211 402f30-402f7e GetTickCount GetModuleFileNameW call 405ede 214 402f80-402f85 211->214 215 402f8a-402fb8 call 4063e8 call 405d09 call 4063e8 GetFileSize 211->215 216 4031cf-4031d3 214->216 223 4030a8-4030b6 call 402e8e 215->223 224 402fbe-402fd5 215->224 231 403187-40318c 223->231 232 4030bc-4030bf 223->232 225 402fd7 224->225 226 402fd9-402fe6 call 403447 224->226 225->226 233 403143-40314b call 402e8e 226->233 234 402fec-402ff2 226->234 231->216 235 4030c1-4030d9 call 40345d call 403447 232->235 236 4030eb-403137 GlobalAlloc call 406923 call 405f0d CreateFileW 232->236 233->231 238 403072-403076 234->238 239 402ff4-40300c call 405e99 234->239 235->231 259 4030df-4030e5 235->259 262 403139-40313e 236->262 263 40314d-40317d call 40345d call 4031d6 236->263 243 403078-40307e call 402e8e 238->243 244 40307f-403085 238->244 239->244 257 40300e-403015 239->257 243->244 250 403087-403095 call 4068b5 244->250 251 403098-4030a2 244->251 250->251 251->223 251->224 257->244 261 403017-40301e 257->261 259->231 259->236 261->244 264 403020-403027 261->264 262->216 270 403182-403185 263->270 264->244 267 403029-403030 264->267 267->244 269 403032-403052 267->269 269->231 271 403058-40305c 269->271 270->231 272 40318e-40319f 270->272 273 403064-40306c 271->273 274 40305e-403062 271->274 276 4031a1 272->276 277 4031a7-4031ac 272->277 273->244 275 40306e-403070 273->275 274->223 274->273 275->244 276->277 278 4031ad-4031b3 277->278 278->278 279 4031b5-4031cd call 405e99 278->279 279->216
                                                                                                                                                                APIs
                                                                                                                                                                • GetTickCount.KERNEL32 ref: 00402F44
                                                                                                                                                                • GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe,00000400), ref: 00402F60
                                                                                                                                                                  • Part of subcall function 00405EDE: GetFileAttributesW.KERNELBASE(00000003,00402F73,C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe,80000000,00000003), ref: 00405EE2
                                                                                                                                                                  • Part of subcall function 00405EDE: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04
                                                                                                                                                                • GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp,C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp,C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe,C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe,80000000,00000003), ref: 00402FA9
                                                                                                                                                                • GlobalAlloc.KERNELBASE(00000040,0040A230), ref: 004030F0
                                                                                                                                                                Strings
                                                                                                                                                                • C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe, xrefs: 00402F4A, 00402F59, 00402F6D, 00402F8A
                                                                                                                                                                • Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403139
                                                                                                                                                                • C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp, xrefs: 00402F8B, 00402F90, 00402F96
                                                                                                                                                                • C:\Users\user\AppData\Local\Temp\, xrefs: 00402F3D, 00403108
                                                                                                                                                                • Error launching installer, xrefs: 00402F80
                                                                                                                                                                • "C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe" /S, xrefs: 00402F30
                                                                                                                                                                • soft, xrefs: 00403020
                                                                                                                                                                • Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403187
                                                                                                                                                                • Null, xrefs: 00403029
                                                                                                                                                                • Inst, xrefs: 00403017
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
                                                                                                                                                                • String ID: "C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe" /S$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp$C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
                                                                                                                                                                • API String ID: 2803837635-3558635251
                                                                                                                                                                • Opcode ID: 490de38a05f78149d95239c3b0bd3a7f561c34765625de5f0c140c9d0421700e
                                                                                                                                                                • Instruction ID: fab51a6d61a7302470dd91ad27108f0c0be819ae48098b15a947b51e22d3bd00
                                                                                                                                                                • Opcode Fuzzy Hash: 490de38a05f78149d95239c3b0bd3a7f561c34765625de5f0c140c9d0421700e
                                                                                                                                                                • Instruction Fuzzy Hash: 4961D271A00205ABDB20DFA4DD45A9A7BA8EB04356F20413FF904F62D1DB7C9A458BAD
                                                                                                                                                                Function 0040640A Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209stringCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 346 40640a-406415 347 406417-406426 346->347 348 406428-40643e 346->348 347->348 349 406444-406451 348->349 350 406656-40665c 348->350 349->350 351 406457-40645e 349->351 352 406662-40666d 350->352 353 406463-406470 350->353 351->350 355 406678-406679 352->355 356 40666f-406673 call 4063e8 352->356 353->352 354 406476-406482 353->354 357 406643 354->357 358 406488-4064c6 354->358 356->355 362 406651-406654 357->362 363 406645-40664f 357->363 360 4065e6-4065ea 358->360 361 4064cc-4064d7 358->361 366 4065ec-4065f2 360->366 367 40661d-406621 360->367 364 4064f0 361->364 365 4064d9-4064de 361->365 362->350 363->350 373 4064f7-4064fe 364->373 365->364 370 4064e0-4064e3 365->370 371 406602-40660e call 4063e8 366->371 372 4065f4-406600 call 40632f 366->372 368 406630-406641 lstrlenW 367->368 369 406623-40662b call 40640a 367->369 368->350 369->368 370->364 375 4064e5-4064e8 370->375 384 406613-406619 371->384 372->384 377 406500-406502 373->377 378 406503-406505 373->378 375->364 380 4064ea-4064ee 375->380 377->378 382 406540-406543 378->382 383 406507-406525 call 4062b6 378->383 380->373 386 406553-406556 382->386 387 406545-406551 GetSystemDirectoryW 382->387 389 40652a-40652e 383->389 384->368 385 40661b 384->385 390 4065de-4065e4 call 40667c 385->390 392 4065c1-4065c3 386->392 393 406558-406566 GetWindowsDirectoryW 386->393 391 4065c5-4065c9 387->391 394 406534-40653b call 40640a 389->394 395 4065ce-4065d1 389->395 390->368 391->390 397 4065cb 391->397 392->391 396 406568-406572 392->396 393->392 394->391 395->390 400 4065d3-4065d9 lstrcatW 395->400 402 406574-406577 396->402 403 40658c-4065a2 SHGetSpecialFolderLocation 396->403 397->395 400->390 402->403 405 406579-406580 402->405 406 4065a4-4065bb SHGetPathFromIDListW CoTaskMemFree 403->406 407 4065bd 403->407 408 406588-40658a 405->408 406->391 406->407 407->392 408->391 408->403
                                                                                                                                                                APIs
                                                                                                                                                                • GetSystemDirectoryW.KERNEL32("C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe" https://www.bitcomet.com/client/install-stats/?l=en_us&file=Bit,00000400), ref: 0040654B
                                                                                                                                                                • GetWindowsDirectoryW.KERNEL32("C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe" https://www.bitcomet.com/client/install-stats/?l=en_us&file=Bit,00000400,00000000,00422708,?,00405487,00422708,00000000), ref: 0040655E
                                                                                                                                                                • SHGetSpecialFolderLocation.SHELL32(00405487,00000000,00000000,00422708,?,00405487,00422708,00000000), ref: 0040659A
                                                                                                                                                                • SHGetPathFromIDListW.SHELL32(00000000,"C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe" https://www.bitcomet.com/client/install-stats/?l=en_us&file=Bit), ref: 004065A8
                                                                                                                                                                • CoTaskMemFree.OLE32(00000000), ref: 004065B3
                                                                                                                                                                • lstrcatW.KERNEL32("C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe" https://www.bitcomet.com/client/install-stats/?l=en_us&file=Bit,\Microsoft\Internet Explorer\Quick Launch), ref: 004065D9
                                                                                                                                                                • lstrlenW.KERNEL32("C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe" https://www.bitcomet.com/client/install-stats/?l=en_us&file=Bit,00000000,00422708,?,00405487,00422708,00000000), ref: 00406631
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
                                                                                                                                                                • String ID: "C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe" https://www.bitcomet.com/client/install-stats/?l=en_us&file=Bit$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
                                                                                                                                                                • API String ID: 717251189-3600420660
                                                                                                                                                                • Opcode ID: a2b01db3f60f7f954ff39a6d01daadad3aad0d9bd747aef2f55d2b9b332750a0
                                                                                                                                                                • Instruction ID: cc84c68a284476d24e00a3f01d451b35d35df0cd5868c7a223589be4a576710b
                                                                                                                                                                • Opcode Fuzzy Hash: a2b01db3f60f7f954ff39a6d01daadad3aad0d9bd747aef2f55d2b9b332750a0
                                                                                                                                                                • Instruction Fuzzy Hash: C7612371A00111ABDF209F64DD41AAE37A5AF50314F62813FE903B62D0E73E9AA2C75D
                                                                                                                                                                Function 0040176F Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 145stringtimeCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 409 40176f-401794 call 402c41 call 405d34 414 401796-40179c call 4063e8 409->414 415 40179e-4017b0 call 4063e8 call 405cbd lstrcatW 409->415 420 4017b5-4017b6 call 40667c 414->420 415->420 424 4017bb-4017bf 420->424 425 4017c1-4017cb call 40672b 424->425 426 4017f2-4017f5 424->426 434 4017dd-4017ef 425->434 435 4017cd-4017db CompareFileTime 425->435 427 4017f7-4017f8 call 405eb9 426->427 428 4017fd-401819 call 405ede 426->428 427->428 436 40181b-40181e 428->436 437 40188d-4018b6 call 405450 call 4031d6 428->437 434->426 435->434 438 401820-40185e call 4063e8 * 2 call 40640a call 4063e8 call 405a4e 436->438 439 40186f-401879 call 405450 436->439 451 4018b8-4018bc 437->451 452 4018be-4018ca SetFileTime 437->452 438->424 471 401864-401865 438->471 449 401882-401888 439->449 454 402ace 449->454 451->452 453 4018d0-4018db FindCloseChangeNotification 451->453 452->453 456 4018e1-4018e4 453->456 457 402ac5-402ac8 453->457 459 402ad0-402ad4 454->459 460 4018e6-4018f7 call 40640a lstrcatW 456->460 461 4018f9-4018fc call 40640a 456->461 457->454 468 401901-4022fc call 405a4e 460->468 461->468 468->457 468->459 471->449 473 401867-401868 471->473 473->439
                                                                                                                                                                APIs
                                                                                                                                                                • lstrcatW.KERNEL32(00000000,00000000), ref: 004017B0
                                                                                                                                                                • CompareFileTime.KERNEL32(-00000014,?,"C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe" https://www.bitcomet.com/client/install-stats/?l=en_us&file=Bit,"C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe" https://www.bitcomet.com/client/install-stats/?l=en_us&file=Bit,00000000,00000000,"C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe" https://www.bitcomet.com/client/install-stats/?l=en_us&file=Bit,C:\Users\user\AppData\Local\Temp\nscA1E4.tmp,?,?,00000031), ref: 004017D5
                                                                                                                                                                  • Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5
                                                                                                                                                                  • Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
                                                                                                                                                                  • Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
                                                                                                                                                                  • Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08), ref: 004054AB
                                                                                                                                                                  • Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
                                                                                                                                                                  • Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
                                                                                                                                                                  • Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
                                                                                                                                                                  • Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
                                                                                                                                                                • String ID: "C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe" https://www.bitcomet.com/client/install-stats/?l=en_us&file=Bit$C:\Users\user\AppData\Local\Temp\nscA1E4.tmp$C:\Users\user\AppData\Local\Temp\nscA1E4.tmp
                                                                                                                                                                • API String ID: 1941528284-1572184870
                                                                                                                                                                • Opcode ID: 9a5bc51b054fa3d2054b83f25f7423f08ec573233d163a5f5bb8c9366ee8d440
                                                                                                                                                                • Instruction ID: 2530360bafa170a9d5e8074bf3c3c5079485a484cad24ccb9f0485aee5561d29
                                                                                                                                                                • Opcode Fuzzy Hash: 9a5bc51b054fa3d2054b83f25f7423f08ec573233d163a5f5bb8c9366ee8d440
                                                                                                                                                                • Instruction Fuzzy Hash: FF41C671900614BADF11ABA5CD85DAF3679EF05329B20433BF412B10E2CB3C86529A6E
                                                                                                                                                                Function 00406752 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 475 406752-406772 GetSystemDirectoryW 476 406774 475->476 477 406776-406778 475->477 476->477 478 406789-40678b 477->478 479 40677a-406783 477->479 481 40678c-4067bf wsprintfW LoadLibraryExW 478->481 479->478 480 406785-406787 479->480 480->481
                                                                                                                                                                APIs
                                                                                                                                                                • GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
                                                                                                                                                                • wsprintfW.USER32 ref: 004067A4
                                                                                                                                                                • LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 004067B8
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: DirectoryLibraryLoadSystemwsprintf
                                                                                                                                                                • String ID: %s%S.dll$UXTHEME$\
                                                                                                                                                                • API String ID: 2200240437-1946221925
                                                                                                                                                                • Opcode ID: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
                                                                                                                                                                • Instruction ID: 07f60acf873a648e61080255fd3e200204736070213a9ab7c1209ab7057fe03e
                                                                                                                                                                • Opcode Fuzzy Hash: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
                                                                                                                                                                • Instruction Fuzzy Hash: 27F0FC70540219AECB10AB68ED0DFAB366CA700304F10447AA64AF20D1EB789A24C798
                                                                                                                                                                Function 004028AD Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                • GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402901
                                                                                                                                                                • GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 0040291D
                                                                                                                                                                • GlobalFree.KERNEL32(?), ref: 00402956
                                                                                                                                                                • GlobalFree.KERNELBASE(00000000), ref: 00402969
                                                                                                                                                                • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402981
                                                                                                                                                                • DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402995
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Global$AllocFree$CloseDeleteFileHandle
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2667972263-0
                                                                                                                                                                • Opcode ID: ca1daf0c84a02556f0ae0f0f0439a2864d74e37ac0f24e18a46676800f978646
                                                                                                                                                                • Instruction ID: fa73a2a76dd28b4b8719808dd60f9f08d060129827b0ffc87b4efdc8f5ae5e12
                                                                                                                                                                • Opcode Fuzzy Hash: ca1daf0c84a02556f0ae0f0f0439a2864d74e37ac0f24e18a46676800f978646
                                                                                                                                                                • Instruction Fuzzy Hash: 3D21BFB1D00124BBCF116FA5DE48D9E7E79EF09364F10023AF9607A2E1CB794D418B98
                                                                                                                                                                Function 0040591F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 517 40591f-40596a CreateDirectoryW 518 405970-40597d GetLastError 517->518 519 40596c-40596e 517->519 520 405997-405999 518->520 521 40597f-405993 SetFileSecurityW 518->521 519->520 521->519 522 405995 GetLastError 521->522 522->520
                                                                                                                                                                APIs
                                                                                                                                                                • CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405962
                                                                                                                                                                • GetLastError.KERNEL32 ref: 00405976
                                                                                                                                                                • SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040598B
                                                                                                                                                                • GetLastError.KERNEL32 ref: 00405995
                                                                                                                                                                Strings
                                                                                                                                                                • C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp, xrefs: 0040591F
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorLast$CreateDirectoryFileSecurity
                                                                                                                                                                • String ID: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp
                                                                                                                                                                • API String ID: 3449924974-3891245195
                                                                                                                                                                • Opcode ID: 4e538d1c76d2fdfb7cd0fd00a6572ed9e7029d57e55293966324597acc96cb40
                                                                                                                                                                • Instruction ID: 649461beb8834c01a631d5941a9b92c7b7a92d05cb5a935181bdf460574ff338
                                                                                                                                                                • Opcode Fuzzy Hash: 4e538d1c76d2fdfb7cd0fd00a6572ed9e7029d57e55293966324597acc96cb40
                                                                                                                                                                • Instruction Fuzzy Hash: DF011AB1C10619DADF009FA5C944BEFBFB4EF14354F00403AE545B6291DB789608CFA9
                                                                                                                                                                Function 00405F0D Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 523 405f0d-405f19 524 405f1a-405f4e GetTickCount GetTempFileNameW 523->524 525 405f50-405f52 524->525 526 405f5d-405f5f 524->526 525->524 527 405f54 525->527 528 405f57-405f5a 526->528 527->528
                                                                                                                                                                APIs
                                                                                                                                                                • GetTickCount.KERNEL32 ref: 00405F2B
                                                                                                                                                                • GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,"C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe" /S,004034A3,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004036EF), ref: 00405F46
                                                                                                                                                                Strings
                                                                                                                                                                • nsa, xrefs: 00405F1A
                                                                                                                                                                • C:\Users\user\AppData\Local\Temp\, xrefs: 00405F12, 00405F16
                                                                                                                                                                • "C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe" /S, xrefs: 00405F0D
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CountFileNameTempTick
                                                                                                                                                                • String ID: "C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe" /S$C:\Users\user\AppData\Local\Temp\$nsa
                                                                                                                                                                • API String ID: 1716503409-1117445528
                                                                                                                                                                • Opcode ID: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
                                                                                                                                                                • Instruction ID: 076564571966e4dc9ef4834731be4d502634ae0aeddccfca5b4533d1bab5a213
                                                                                                                                                                • Opcode Fuzzy Hash: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
                                                                                                                                                                • Instruction Fuzzy Hash: 14F09076601204FFEB009F59ED05E9BB7A8EB95750F10803AEE00F7250E6B49A548B68
                                                                                                                                                                Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63registryCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 529 402d44-402d6d call 406255 531 402d72-402d74 529->531 532 402d76-402d7c 531->532 533 402dec-402df0 531->533 534 402d98-402dad RegEnumKeyW 532->534 535 402d7e-402d80 534->535 536 402daf-402dc1 RegCloseKey call 4067c2 534->536 538 402dd0-402dde RegCloseKey 535->538 539 402d82-402d96 call 402d44 535->539 543 402de0-402de6 RegDeleteKeyW 536->543 544 402dc3-402dce 536->544 538->533 539->534 539->536 543->533 544->533
                                                                                                                                                                APIs
                                                                                                                                                                • RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
                                                                                                                                                                • RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
                                                                                                                                                                • RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Close$Enum
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 464197530-0
                                                                                                                                                                • Opcode ID: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
                                                                                                                                                                • Instruction ID: 3410daaf41eb2a8de7896e1fb7aa518538b3e031ab7f3cb45a1fbd23233d04dd
                                                                                                                                                                • Opcode Fuzzy Hash: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
                                                                                                                                                                • Instruction Fuzzy Hash: CE116A32500108FBDF12AB90CE09FEE7B7DAF44350F100076B905B61E0E7B59E21AB58
                                                                                                                                                                Function 004015C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 629 4015c1-4015d5 call 402c41 call 405d68 634 401631-401634 629->634 635 4015d7-4015ea call 405cea 629->635 637 401663-402250 call 401423 634->637 638 401636-401655 call 401423 call 4063e8 SetCurrentDirectoryW 634->638 643 401604-401607 call 40599c 635->643 644 4015ec-4015ef 635->644 651 402ac5-402ad4 637->651 652 40288b-402892 637->652 638->651 658 40165b-40165e 638->658 650 40160c-40160e 643->650 644->643 648 4015f1-4015f8 call 4059b9 644->648 648->643 662 4015fa-4015fd call 40591f 648->662 655 401610-401615 650->655 656 401627-40162f 650->656 652->651 660 401624 655->660 661 401617-401622 GetFileAttributesW 655->661 656->634 656->635 658->651 660->656 661->656 661->660 665 401602 662->665 665->650
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00405D68: CharNextW.USER32(?,?,00425F30,?,00405DDC,00425F30,00425F30,?,?,74DF2EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,74DF2EE0,00000000), ref: 00405D76
                                                                                                                                                                  • Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
                                                                                                                                                                  • Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93
                                                                                                                                                                • GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A
                                                                                                                                                                  • Part of subcall function 0040591F: CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405962
                                                                                                                                                                • SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\Temp\nscA1E4.tmp,?,00000000,000000F0), ref: 0040164D
                                                                                                                                                                Strings
                                                                                                                                                                • C:\Users\user\AppData\Local\Temp\nscA1E4.tmp, xrefs: 00401640
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CharNext$Directory$AttributesCreateCurrentFile
                                                                                                                                                                • String ID: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp
                                                                                                                                                                • API String ID: 1892508949-3719291795
                                                                                                                                                                • Opcode ID: c670449cb20163be3cb3cb34affd8c81282aa0e3ca4a40f31796d9e50139b1da
                                                                                                                                                                • Instruction ID: 0139da5d792eeb989572d84d187c25f91b4f70b2bd1842bf542401118de2a59f
                                                                                                                                                                • Opcode Fuzzy Hash: c670449cb20163be3cb3cb34affd8c81282aa0e3ca4a40f31796d9e50139b1da
                                                                                                                                                                • Instruction Fuzzy Hash: 0511E631504511EBCF30AFA4CD4159F36A0EF15329B29453BFA45B22F1DB3E49419B5D
                                                                                                                                                                Function 00405DC5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 666 405dc5-405de0 call 4063e8 call 405d68 671 405de2-405de4 666->671 672 405de6-405df3 call 40667c 666->672 673 405e3e-405e40 671->673 676 405e03-405e07 672->676 677 405df5-405dfb 672->677 679 405e1d-405e26 lstrlenW 676->679 677->671 678 405dfd-405e01 677->678 678->671 678->676 680 405e28-405e3c call 405cbd GetFileAttributesW 679->680 681 405e09-405e10 call 40672b 679->681 680->673 686 405e12-405e15 681->686 687 405e17-405e18 call 405d09 681->687 686->671 686->687 687->679
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00000400,00403576,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5
                                                                                                                                                                  • Part of subcall function 00405D68: CharNextW.USER32(?,?,00425F30,?,00405DDC,00425F30,00425F30,?,?,74DF2EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,74DF2EE0,00000000), ref: 00405D76
                                                                                                                                                                  • Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
                                                                                                                                                                  • Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93
                                                                                                                                                                • lstrlenW.KERNEL32(00425F30,00000000,00425F30,00425F30,?,?,74DF2EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,74DF2EE0,00000000), ref: 00405E1E
                                                                                                                                                                • GetFileAttributesW.KERNELBASE(00425F30,00425F30,00425F30,00425F30,00425F30,00425F30,00000000,00425F30,00425F30,?,?,74DF2EE0,00405B1A,?,C:\Users\user\AppData\Local\Temp\,74DF2EE0), ref: 00405E2E
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CharNext$AttributesFilelstrcpynlstrlen
                                                                                                                                                                • String ID: 0_B
                                                                                                                                                                • API String ID: 3248276644-2128305573
                                                                                                                                                                • Opcode ID: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
                                                                                                                                                                • Instruction ID: e2ef3bf648e1011fa726b67e088789f036b8871ba300d86fb9c867912b04298b
                                                                                                                                                                • Opcode Fuzzy Hash: df6e64e4f6769b316d4c1c7beb25aaa03b2c49ca2ab4503c480f7fe4b4eab687
                                                                                                                                                                • Instruction Fuzzy Hash: B4F0F439109E5116D62233365D09BEF0548CF82354B5A853BFC91B22D2DB3C8A539DFE
                                                                                                                                                                Function 004062B6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 689 4062b6-4062e8 call 406255 692 406326 689->692 693 4062ea-406318 RegQueryValueExW RegCloseKey 689->693 695 40632a-40632c 692->695 693->692 694 40631a-40631e 693->694 694->695 696 406320-406324 694->696 696->692 696->695
                                                                                                                                                                APIs
                                                                                                                                                                • RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,?,00000800,00000002,00422708,00000000,?,?,"C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe" https://www.bitcomet.com/client/install-stats/?l=en_us&file=Bit,?,?,0040652A,80000002), ref: 004062FC
                                                                                                                                                                • RegCloseKey.KERNELBASE(?,?,0040652A,80000002,Software\Microsoft\Windows\CurrentVersion,"C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe" https://www.bitcomet.com/client/install-stats/?l=en_us&file=Bit,"C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe" https://www.bitcomet.com/client/install-stats/?l=en_us&file=Bit,"C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe" https://www.bitcomet.com/client/install-stats/?l=en_us&file=Bit,00000000,00422708), ref: 00406307
                                                                                                                                                                Strings
                                                                                                                                                                • "C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe" https://www.bitcomet.com/client/install-stats/?l=en_us&file=Bit, xrefs: 004062BD
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseQueryValue
                                                                                                                                                                • String ID: "C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe" https://www.bitcomet.com/client/install-stats/?l=en_us&file=Bit
                                                                                                                                                                • API String ID: 3356406503-675013823
                                                                                                                                                                • Opcode ID: c86c14991d827863ed80974af0b6eb11eee99485bcf286d774b2a77da772c934
                                                                                                                                                                • Instruction ID: efe3e51cb47fe95fa6bbb83f3cb46ebf457b8c4b35673ac5825ceff03b23bf8b
                                                                                                                                                                • Opcode Fuzzy Hash: c86c14991d827863ed80974af0b6eb11eee99485bcf286d774b2a77da772c934
                                                                                                                                                                • Instruction Fuzzy Hash: B301717250020AEBDF218F55CD09EDB3FA9EF55354F114039FD15A2150E778D964CBA4
                                                                                                                                                                Function 004059D1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 004059FA
                                                                                                                                                                • CloseHandle.KERNEL32(?), ref: 00405A07
                                                                                                                                                                Strings
                                                                                                                                                                • Error launching installer, xrefs: 004059E4
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseCreateHandleProcess
                                                                                                                                                                • String ID: Error launching installer
                                                                                                                                                                • API String ID: 3712363035-66219284
                                                                                                                                                                • Opcode ID: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
                                                                                                                                                                • Instruction ID: 166b032e71181ba573d10d742cd21a74b10ba840f41c43b266edefbe5b435367
                                                                                                                                                                • Opcode Fuzzy Hash: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
                                                                                                                                                                • Instruction Fuzzy Hash: E5E04FB0A102097FEB009B64ED49F7B76ACFB04208F404531BD00F2150D774A8208A7C
                                                                                                                                                                Function 00403A43 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • FreeLibrary.KERNELBASE(?,C:\Users\user\AppData\Local\Temp\,00000000,74DF2EE0,00403A1A,74DF3420,00403819,00000006,?,00000006,00000008,0000000A), ref: 00403A5D
                                                                                                                                                                • GlobalFree.KERNEL32(?), ref: 00403A64
                                                                                                                                                                Strings
                                                                                                                                                                • C:\Users\user\AppData\Local\Temp\, xrefs: 00403A55
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Free$GlobalLibrary
                                                                                                                                                                • String ID: C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                • API String ID: 1100898210-3081826266
                                                                                                                                                                • Opcode ID: e06207bb45b670d34af272b3fb1259f6a40c1f68299225e6b4906b67dd7614d2
                                                                                                                                                                • Instruction ID: 7abb624b42f0eb5bf3103b67fd66c27476adae564a61ccebc81435f3e7eba37d
                                                                                                                                                                • Opcode Fuzzy Hash: e06207bb45b670d34af272b3fb1259f6a40c1f68299225e6b4906b67dd7614d2
                                                                                                                                                                • Instruction Fuzzy Hash: 73E0EC326111205BC6229F59AD44B5E776D6F58B22F0A023AE8C07B26087745D938F98
                                                                                                                                                                Function 00406F27 Relevance: 5.2, APIs: 4, Instructions: 236COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
                                                                                                                                                                • Instruction ID: 2bd06e12bed6e0bcd81d630d0cd78bd49004ac77cb8b5ebb757de7108a839e92
                                                                                                                                                                • Opcode Fuzzy Hash: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
                                                                                                                                                                • Instruction Fuzzy Hash: 1DA14471E04228CBDF28CFA8C8446ADBBB1FF44305F14806ED856BB281D7786A86DF45
                                                                                                                                                                Function 00407128 Relevance: 5.2, APIs: 4, Instructions: 208COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
                                                                                                                                                                • Instruction ID: f1da02a2f8b93330a3d469e31e6e9edf047fa596270f1f1d86c95cc791e20b04
                                                                                                                                                                • Opcode Fuzzy Hash: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
                                                                                                                                                                • Instruction Fuzzy Hash: AA910271E04228CBEF28CF98C8447ADBBB1FB45305F14816AD856BB291C778A986DF45
                                                                                                                                                                Function 00406E3E Relevance: 5.2, APIs: 4, Instructions: 205COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
                                                                                                                                                                • Instruction ID: fb1d02f26201205f5bfcbd3029eb7cfad7cca69a3f8c46de7b35964bdd0c3f7d
                                                                                                                                                                • Opcode Fuzzy Hash: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
                                                                                                                                                                • Instruction Fuzzy Hash: 18814571E04228DFDF24CFA8C844BADBBB1FB45305F24816AD856BB291C7389986DF45
                                                                                                                                                                Function 00406943 Relevance: 5.2, APIs: 4, Instructions: 198COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
                                                                                                                                                                • Instruction ID: 55fc176551b00f8465723d30588461dcf2fc1d3195b414c524ee7a2fcbdbe87b
                                                                                                                                                                • Opcode Fuzzy Hash: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
                                                                                                                                                                • Instruction Fuzzy Hash: 39815971E04228DBEF24CFA8C844BADBBB1FB45305F14816AD856BB2C1C7786986DF45
                                                                                                                                                                Function 00406D91 Relevance: 5.2, APIs: 4, Instructions: 180COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
                                                                                                                                                                • Instruction ID: 7645ab34ef40ba223d211dbe726f8302725d3f31b3e808d93cc70016d3e0d248
                                                                                                                                                                • Opcode Fuzzy Hash: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
                                                                                                                                                                • Instruction Fuzzy Hash: 10711471E04228DBDF24CF98C8447ADBBB1FF49305F15806AD856BB281C7389A86DF45
                                                                                                                                                                Function 00406EAF Relevance: 5.2, APIs: 4, Instructions: 170COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
                                                                                                                                                                • Instruction ID: a4e19b7408f2815589132e7e2b866ae2b9c8caa40868d81b8a4623295251dea3
                                                                                                                                                                • Opcode Fuzzy Hash: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
                                                                                                                                                                • Instruction Fuzzy Hash: 0D712571E04218DBEF28CF98C844BADBBB1FF45305F15806AD856BB281C7389986DF45
                                                                                                                                                                Function 00406DFB Relevance: 5.2, APIs: 4, Instructions: 168COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
                                                                                                                                                                • Instruction ID: 979076adb26e5f1e3e7a9458f232081f51f9a0722543042d1d726f4d31452a21
                                                                                                                                                                • Opcode Fuzzy Hash: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
                                                                                                                                                                • Instruction Fuzzy Hash: 50714871E04228DBEF28CF98C8447ADBBB1FF45305F15806AD856BB281C7386A46DF45
                                                                                                                                                                Function 004032DE Relevance: 4.6, APIs: 3, Instructions: 101COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetTickCount.KERNEL32 ref: 004032F2
                                                                                                                                                                  • Part of subcall function 0040345D: SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040315B,?), ref: 0040346B
                                                                                                                                                                • SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,00403208,00000004,00000000,00000000,?,?,00403182,000000FF,00000000,00000000,0040A230,?), ref: 00403325
                                                                                                                                                                • SetFilePointer.KERNELBASE(053EA3F1,00000000,00000000,00414ED0,00004000,?,00000000,00403208,00000004,00000000,00000000,?,?,00403182,000000FF,00000000), ref: 00403420
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FilePointer$CountTick
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1092082344-0
                                                                                                                                                                • Opcode ID: f3fb30f2448ce3ccf57cf7b840c8449ec2ed2fd8cdee9bb7cd3145c6374fc973
                                                                                                                                                                • Instruction ID: a2c2ae871b20a7f651e14226ae934804f023725c52e887911cb1b1382089a511
                                                                                                                                                                • Opcode Fuzzy Hash: f3fb30f2448ce3ccf57cf7b840c8449ec2ed2fd8cdee9bb7cd3145c6374fc973
                                                                                                                                                                • Instruction Fuzzy Hash: 54313872610215DBD721DF29EEC496A3BA9F74039A754433FE900F62E0CBB99D018B9D
                                                                                                                                                                Function 00402032 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 0040205D
                                                                                                                                                                  • Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
                                                                                                                                                                  • Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
                                                                                                                                                                  • Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08), ref: 004054AB
                                                                                                                                                                  • Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
                                                                                                                                                                  • Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
                                                                                                                                                                  • Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
                                                                                                                                                                  • Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B
                                                                                                                                                                • LoadLibraryExW.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 0040206E
                                                                                                                                                                • FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 004020EB
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 334405425-0
                                                                                                                                                                • Opcode ID: c0091ceae9cfbdad611b36e7acbab474ec2c1bafca6550aebcba3b122e164ceb
                                                                                                                                                                • Instruction ID: 38390b8595ebf5dc4f6cf14c4d4b7ed92d06cc21542818b97b262269bef072d5
                                                                                                                                                                • Opcode Fuzzy Hash: c0091ceae9cfbdad611b36e7acbab474ec2c1bafca6550aebcba3b122e164ceb
                                                                                                                                                                • Instruction Fuzzy Hash: DC218331D00215BACF20AFA5CE4D99E7A70BF04358F60413BF511B51E0DBBD8991DA6E
                                                                                                                                                                Function 00401B77 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GlobalFree.KERNEL32(00000000), ref: 00401BE7
                                                                                                                                                                • GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401BF9
                                                                                                                                                                Strings
                                                                                                                                                                • "C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe" https://www.bitcomet.com/client/install-stats/?l=en_us&file=Bit, xrefs: 00401B9E, 00401BA4, 00401BBE
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Global$AllocFree
                                                                                                                                                                • String ID: "C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe" https://www.bitcomet.com/client/install-stats/?l=en_us&file=Bit
                                                                                                                                                                • API String ID: 3394109436-675013823
                                                                                                                                                                • Opcode ID: f7405ea9e476423423cde41a6620a17073824cabe1c2d7eedde19d286f021b37
                                                                                                                                                                • Instruction ID: 4b9c6e54fa6809cb214bd66434af352d7e41d31d349781cb692caa9f676c35e6
                                                                                                                                                                • Opcode Fuzzy Hash: f7405ea9e476423423cde41a6620a17073824cabe1c2d7eedde19d286f021b37
                                                                                                                                                                • Instruction Fuzzy Hash: 6E217B73A00200D7DB20EB94CEC995E73A4AB45314765053BF506F32D1DBB8E851DBAD
                                                                                                                                                                Function 004023E4 Relevance: 4.6, APIs: 3, Instructions: 64registrystringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • lstrlenW.KERNEL32(0040B5D8,00000023,00000011,00000002), ref: 0040242F
                                                                                                                                                                • RegSetValueExW.KERNELBASE(?,?,?,?,0040B5D8,00000000,00000011,00000002), ref: 0040246F
                                                                                                                                                                • RegCloseKey.KERNELBASE(?,?,?,0040B5D8,00000000,00000011,00000002), ref: 00402557
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseValuelstrlen
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2655323295-0
                                                                                                                                                                • Opcode ID: d3a746a6bbac3f82573acd3c3756226cf7e5e9da6551c7a7d6b941e2adb29f52
                                                                                                                                                                • Instruction ID: 2320c74fc41ffeb716861e397aa06506e2c1d49fdd3331f7b5a779c93e7e4390
                                                                                                                                                                • Opcode Fuzzy Hash: d3a746a6bbac3f82573acd3c3756226cf7e5e9da6551c7a7d6b941e2adb29f52
                                                                                                                                                                • Instruction Fuzzy Hash: C4118471E00104BEEB10AFA5DE89EAEBB74EB44754F11803BF504B71D1DBB89D419B68
                                                                                                                                                                Function 004024F8 Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 0040252B
                                                                                                                                                                • RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 0040253E
                                                                                                                                                                • RegCloseKey.KERNELBASE(?,?,?,0040B5D8,00000000,00000011,00000002), ref: 00402557
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Enum$CloseValue
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 397863658-0
                                                                                                                                                                • Opcode ID: 962e8dbebea2d0e856bbe812d5e95e45bdf7d67f5620c7d5b12d357826d7025c
                                                                                                                                                                • Instruction ID: 69a0bd767b5398a5b54c194fc83da7942780fa4e63ecbf8b5358c30743fc2944
                                                                                                                                                                • Opcode Fuzzy Hash: 962e8dbebea2d0e856bbe812d5e95e45bdf7d67f5620c7d5b12d357826d7025c
                                                                                                                                                                • Instruction Fuzzy Hash: 4B017171904204ABEB149F95DE88ABF7AB8EF80348F10403EF505B61D0DAB85E419B69
                                                                                                                                                                Function 00405AB2 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00405EB9: GetFileAttributesW.KERNELBASE(?,?,00405ABE,?,?,00000000,00405C94,?,?,?,?), ref: 00405EBE
                                                                                                                                                                  • Part of subcall function 00405EB9: SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405ED2
                                                                                                                                                                • RemoveDirectoryW.KERNELBASE(?,?,?,00000000,00405C94), ref: 00405ACD
                                                                                                                                                                • DeleteFileW.KERNELBASE(?,?,?,00000000,00405C94), ref: 00405AD5
                                                                                                                                                                • SetFileAttributesW.KERNEL32(?,00000000), ref: 00405AED
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$Attributes$DeleteDirectoryRemove
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1655745494-0
                                                                                                                                                                • Opcode ID: ee26814d0e89ccba1e58ecbc8b5a308cd0754c8ce938ef3c5221310ac7d33209
                                                                                                                                                                • Instruction ID: 2750ea62591d09886f88fd119c0b0bc2019991ac89723f17ff6745a253c15028
                                                                                                                                                                • Opcode Fuzzy Hash: ee26814d0e89ccba1e58ecbc8b5a308cd0754c8ce938ef3c5221310ac7d33209
                                                                                                                                                                • Instruction Fuzzy Hash: 6CE0E531305A9056C7106B759A48B5B3AD8EF8E324F060B3BF592F11C0CBB845068FBD
                                                                                                                                                                Function 004039E6 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 20COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CloseHandle.KERNEL32(FFFFFFFF,74DF3420,00403819,00000006,?,00000006,00000008,0000000A), ref: 004039F8
                                                                                                                                                                • CloseHandle.KERNEL32(FFFFFFFF,74DF3420,00403819,00000006,?,00000006,00000008,0000000A), ref: 00403A0C
                                                                                                                                                                Strings
                                                                                                                                                                • C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\, xrefs: 00403A1C
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseHandle
                                                                                                                                                                • String ID: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\
                                                                                                                                                                • API String ID: 2962429428-3640958799
                                                                                                                                                                • Opcode ID: da7f190e0ba48897d51f9f236d42b5a012c81fce650680f21bb6a2f903491feb
                                                                                                                                                                • Instruction ID: 07f3e9af7cf607af2e3904837c536be1bfb9407632cbf68cc23e2c2b6ee6fca0
                                                                                                                                                                • Opcode Fuzzy Hash: da7f190e0ba48897d51f9f236d42b5a012c81fce650680f21bb6a2f903491feb
                                                                                                                                                                • Instruction Fuzzy Hash: 8FE0863564071496C524EF7CBD4D5853A185B853357204326F0B9F20F0C7389A675E99
                                                                                                                                                                Function 004031D6 Relevance: 3.1, APIs: 2, Instructions: 88COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SetFilePointer.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,?,?,00403182,000000FF,00000000,00000000,0040A230,?), ref: 004031FB
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FilePointer
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 973152223-0
                                                                                                                                                                • Opcode ID: 131c812928c6c35335534bcb02e2daa94b136faef127733fd811d82e412704b4
                                                                                                                                                                • Instruction ID: f938e70baf20f89fc7421c1cbc4d65c8cbb1a4a40291e2e844035b0cdbff1196
                                                                                                                                                                • Opcode Fuzzy Hash: 131c812928c6c35335534bcb02e2daa94b136faef127733fd811d82e412704b4
                                                                                                                                                                • Instruction Fuzzy Hash: 53314B30200219BBDB109F95ED84ADA3E68EB04759F20857EF905E62D0D6789A509BA9
                                                                                                                                                                Function 00402484 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,?,?), ref: 004024B5
                                                                                                                                                                • RegCloseKey.KERNELBASE(?,?,?,0040B5D8,00000000,00000011,00000002), ref: 00402557
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseQueryValue
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3356406503-0
                                                                                                                                                                • Opcode ID: 63b64fe82c2f511c8169af5ec8c0190f19a921c94039209ad64b866aaad41420
                                                                                                                                                                • Instruction ID: 8b4d26b48c61f4aea5aea8b01f6eaa690eaa4425e6198d6413393360261ed691
                                                                                                                                                                • Opcode Fuzzy Hash: 63b64fe82c2f511c8169af5ec8c0190f19a921c94039209ad64b866aaad41420
                                                                                                                                                                • Instruction Fuzzy Hash: 61119431910205EBDB14DF64CA585AE7BB4EF44348F20843FE445B72D0D6B85A81EB5A
                                                                                                                                                                Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
                                                                                                                                                                • SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageSend
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3850602802-0
                                                                                                                                                                • Opcode ID: 23ed1533968369fb0e08a97211bc38e5ec6adcca8744e4a1682e6817b2d67833
                                                                                                                                                                • Instruction ID: 4945fb4554c9d48a14a82d28c5fc4c127f2c3d85d8aa5c2a63fae023cf5e702c
                                                                                                                                                                • Opcode Fuzzy Hash: 23ed1533968369fb0e08a97211bc38e5ec6adcca8744e4a1682e6817b2d67833
                                                                                                                                                                • Instruction Fuzzy Hash: AB01F431724210EBEB199B789D04B2A3698E710714F104A7FF855F62F1DA78CC529B5D
                                                                                                                                                                Function 0040238E Relevance: 3.0, APIs: 2, Instructions: 39registryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 004023B0
                                                                                                                                                                • RegCloseKey.ADVAPI32(00000000), ref: 004023B9
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseDeleteValue
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2831762973-0
                                                                                                                                                                • Opcode ID: a00859f013a8106156cc87040160a2b11e5294e3cc8a521d5b70861134e176e9
                                                                                                                                                                • Instruction ID: 92c71ce55c792e737e0c56b3c5c8c262173643586798c2a655fc457b9e75749a
                                                                                                                                                                • Opcode Fuzzy Hash: a00859f013a8106156cc87040160a2b11e5294e3cc8a521d5b70861134e176e9
                                                                                                                                                                • Instruction Fuzzy Hash: 5FF0F632E041109BE700BBA49B8EABE72A49B44314F29003FFE42F31C0CAF85D42976D
                                                                                                                                                                Function 004067C2 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,?), ref: 004067EF
                                                                                                                                                                  • Part of subcall function 00406752: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
                                                                                                                                                                  • Part of subcall function 00406752: wsprintfW.USER32 ref: 004067A4
                                                                                                                                                                  • Part of subcall function 00406752: LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 004067B8
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2547128583-0
                                                                                                                                                                • Opcode ID: 71f8146864d8eff68e3c3a37d405e8799170f9f4b34abf11e2e746abc88ab69b
                                                                                                                                                                • Instruction ID: 7b80e99db610fb1a261844a57c40f0e669857592e3492eb3b2a0c0f7ce0b312d
                                                                                                                                                                • Opcode Fuzzy Hash: 71f8146864d8eff68e3c3a37d405e8799170f9f4b34abf11e2e746abc88ab69b
                                                                                                                                                                • Instruction Fuzzy Hash: 14E086325042115BD21057745E48D3762AC9AC4704307843EF556F3041DB78DC35B66E
                                                                                                                                                                Function 00405EDE Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetFileAttributesW.KERNELBASE(00000003,00402F73,C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe,80000000,00000003), ref: 00405EE2
                                                                                                                                                                • CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$AttributesCreate
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 415043291-0
                                                                                                                                                                • Opcode ID: 133c91a1dbaf88dbfd801214b1c0a7aa23d67a900b7421546c440c33baf3910c
                                                                                                                                                                • Instruction ID: 5201df1ff3c0a0bd0294a98706b79309786c42e99614e685d4e3591f63f4d9e2
                                                                                                                                                                • Opcode Fuzzy Hash: 133c91a1dbaf88dbfd801214b1c0a7aa23d67a900b7421546c440c33baf3910c
                                                                                                                                                                • Instruction Fuzzy Hash: D5D09E31254601AFEF098F20DE16F2E7AA2EB84B04F11552CB7C2940E0DA7158199B15
                                                                                                                                                                Function 00405EB9 Relevance: 3.0, APIs: 2, Instructions: 13COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetFileAttributesW.KERNELBASE(?,?,00405ABE,?,?,00000000,00405C94,?,?,?,?), ref: 00405EBE
                                                                                                                                                                • SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405ED2
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AttributesFile
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3188754299-0
                                                                                                                                                                • Opcode ID: abb1859115452ae29e15aed1e23886b2a100c548e8c413493f0cbd9ae974b18a
                                                                                                                                                                • Instruction ID: 9f0be338fa0adf84d9e7c2e76c5bc37ea56a51acd28ddc8ab22a7b028afbcef4
                                                                                                                                                                • Opcode Fuzzy Hash: abb1859115452ae29e15aed1e23886b2a100c548e8c413493f0cbd9ae974b18a
                                                                                                                                                                • Instruction Fuzzy Hash: 13D01272504420AFC2502738EF0C89FBF95DB543717124B35FAE9A22F0CB304C568A98
                                                                                                                                                                Function 0040599C Relevance: 3.0, APIs: 2, Instructions: 9COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CreateDirectoryW.KERNELBASE(?,00000000,00403498,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004036EF,?,00000006,00000008,0000000A), ref: 004059A2
                                                                                                                                                                • GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 004059B0
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateDirectoryErrorLast
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1375471231-0
                                                                                                                                                                • Opcode ID: 2a128b8619e21daab1f352946d406dfe7ea7319ba132ee6f2f415100985951e7
                                                                                                                                                                • Instruction ID: 01a40f06620425e1c555583f7199589d3835b04f5715874dbca4219b9923c3a9
                                                                                                                                                                • Opcode Fuzzy Hash: 2a128b8619e21daab1f352946d406dfe7ea7319ba132ee6f2f415100985951e7
                                                                                                                                                                • Instruction Fuzzy Hash: D6C04C71216502DAF7115F31DF09B177A50AB60751F11843AA146E11A4DA349455D92D
                                                                                                                                                                Function 0040230C Relevance: 1.5, APIs: 1, Instructions: 25COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • WritePrivateProfileStringW.KERNEL32(00000000,00000000,?,00000000), ref: 00402343
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: PrivateProfileStringWrite
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 390214022-0
                                                                                                                                                                • Opcode ID: 8d5bed1eaa9c21b7d608f8919ca3b143956f4a650d469f74d9cd9ecffb6d68ea
                                                                                                                                                                • Instruction ID: c1725c34c84eed099ded2eadaed0aef72a921931f8640c1422412bc8ca1d20e4
                                                                                                                                                                • Opcode Fuzzy Hash: 8d5bed1eaa9c21b7d608f8919ca3b143956f4a650d469f74d9cd9ecffb6d68ea
                                                                                                                                                                • Instruction Fuzzy Hash: 89E086315046246BEB1436F10F8DABF10589B54305B19053FBE46B61D7D9FC0D81526D
                                                                                                                                                                Function 00406283 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402CF2,00000000,?,?), ref: 004062AC
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Create
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2289755597-0
                                                                                                                                                                • Opcode ID: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
                                                                                                                                                                • Instruction ID: b492cd94208fe9a136032c47e7ca6226b28abdd7f17191690e67bc203102cabe
                                                                                                                                                                • Opcode Fuzzy Hash: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
                                                                                                                                                                • Instruction Fuzzy Hash: 94E0E672010209BEDF195F50DD0AD7B371DEB04304F11492EFA06D4051E6B5AD706634
                                                                                                                                                                Function 00405F61 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ReadFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,00414ED0,0040CED0,0040345A,0040A230,0040A230,0040335E,00414ED0,00004000,?,00000000,00403208), ref: 00405F75
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FileRead
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2738559852-0
                                                                                                                                                                • Opcode ID: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
                                                                                                                                                                • Instruction ID: 5f0138a6a2c6563494c064dd15accf188ef387db15323854b273470b931b092f
                                                                                                                                                                • Opcode Fuzzy Hash: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
                                                                                                                                                                • Instruction Fuzzy Hash: 7AE0EC3221025AAFDF109E959D04EFB7B6CEB05360F044836FD15E6150D675E8619BA4
                                                                                                                                                                Function 00405F90 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • WriteFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,0040E5DD,0040CED0,004033DE,0040CED0,0040E5DD,00414ED0,00004000,?,00000000,00403208,00000004), ref: 00405FA4
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FileWrite
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3934441357-0
                                                                                                                                                                • Opcode ID: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
                                                                                                                                                                • Instruction ID: 11bffb161eade2b6c2cb4bf4b25223a29cd6195b7324502744f40ed25e3c63a9
                                                                                                                                                                • Opcode Fuzzy Hash: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
                                                                                                                                                                • Instruction Fuzzy Hash: 20E08C3220125BEBEF119E518C00AEBBB6CFB003A0F004432FD11E3180D234E9208BA8
                                                                                                                                                                Function 00406255 Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,00422708,?,?,004062E3,00422708,00000000,?,?,"C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe" https://www.bitcomet.com/client/install-stats/?l=en_us&file=Bit,?), ref: 00406279
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Open
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 71445658-0
                                                                                                                                                                • Opcode ID: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
                                                                                                                                                                • Instruction ID: 7481b87947078d819ae160a747d33610cb99cd3c2235475b1dc937127606ac98
                                                                                                                                                                • Opcode Fuzzy Hash: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
                                                                                                                                                                • Instruction Fuzzy Hash: C1D0123210420DBBDF11AE90DD01FAB372DAF14714F114826FE06A4091D775D530AB14
                                                                                                                                                                Function 004061AE Relevance: 1.5, APIs: 1, Instructions: 13COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • MoveFileExW.KERNELBASE(?,?,00000005,00405CAC,?,00000000,000000F1,?,?,?,?,?), ref: 004061B8
                                                                                                                                                                  • Part of subcall function 00406034: CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,004061CF,?,?), ref: 0040606F
                                                                                                                                                                  • Part of subcall function 00406034: GetShortPathNameW.KERNEL32(?,00426DC8,00000400), ref: 00406078
                                                                                                                                                                  • Part of subcall function 00406034: GetShortPathNameW.KERNEL32(?,004275C8,00000400), ref: 00406095
                                                                                                                                                                  • Part of subcall function 00406034: wsprintfA.USER32 ref: 004060B3
                                                                                                                                                                  • Part of subcall function 00406034: GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,00000004,004275C8,?,?,?,?,?), ref: 004060EE
                                                                                                                                                                  • Part of subcall function 00406034: GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 004060FD
                                                                                                                                                                  • Part of subcall function 00406034: lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406135
                                                                                                                                                                  • Part of subcall function 00406034: SetFilePointer.KERNEL32(0040A590,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A590,00000000,[Rename],00000000,00000000,00000000), ref: 0040618B
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$NamePathShort$AllocCloseGlobalHandleMovePointerSizelstrcpywsprintf
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1930046112-0
                                                                                                                                                                • Opcode ID: 5c2981ee78e9eb91a8062b4a72072cacb1ad6239914bb5b9483364dec19f5c12
                                                                                                                                                                • Instruction ID: 5aa6f9974597dedd37f8aaa805523440b9eb5e1f4d2a52af426e9488f745fafc
                                                                                                                                                                • Opcode Fuzzy Hash: 5c2981ee78e9eb91a8062b4a72072cacb1ad6239914bb5b9483364dec19f5c12
                                                                                                                                                                • Instruction Fuzzy Hash: 5AD0C731148201BFDB155B10DD0591B7FA5FB50355F11C43EF585540B1EB328475DF05
                                                                                                                                                                Function 0040345D Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040315B,?), ref: 0040346B
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FilePointer
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 973152223-0
                                                                                                                                                                • Opcode ID: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
                                                                                                                                                                • Instruction ID: c7266a3154837caca095f11e7777f6dda2278cbf6cff4ee7664d3894fc3aa091
                                                                                                                                                                • Opcode Fuzzy Hash: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
                                                                                                                                                                • Instruction Fuzzy Hash: ECB01271240300BFDA214F00DF09F057B21AB90700F10C034B348380F086711035EB0D
                                                                                                                                                                Function 00401F06 Relevance: 1.3, APIs: 1, Instructions: 37COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
                                                                                                                                                                  • Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
                                                                                                                                                                  • Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08), ref: 004054AB
                                                                                                                                                                  • Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
                                                                                                                                                                  • Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
                                                                                                                                                                  • Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
                                                                                                                                                                  • Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B
                                                                                                                                                                  • Part of subcall function 004059D1: CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 004059FA
                                                                                                                                                                  • Part of subcall function 004059D1: CloseHandle.KERNEL32(?), ref: 00405A07
                                                                                                                                                                • CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401F4D
                                                                                                                                                                  • Part of subcall function 00406873: WaitForSingleObject.KERNEL32(?,00000064), ref: 00406884
                                                                                                                                                                  • Part of subcall function 00406873: GetExitCodeProcess.KERNEL32(?,?), ref: 004068A6
                                                                                                                                                                  • Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2972824698-0
                                                                                                                                                                • Opcode ID: 5e5b465333fec5b7874037cf2aafd3ecfbfec6c2ca92792f458a5198b9edb466
                                                                                                                                                                • Instruction ID: 10a4e636b43d3a3985a1d0cc463e40b1499b59a482d83744678f668e8fa05086
                                                                                                                                                                • Opcode Fuzzy Hash: 5e5b465333fec5b7874037cf2aafd3ecfbfec6c2ca92792f458a5198b9edb466
                                                                                                                                                                • Instruction Fuzzy Hash: 9BF09632905011D7CB20FBA189445DE77A49F40318B24417BF901B21D1C77D4D419A6E

                                                                                                                                                                Non-executed Functions

                                                                                                                                                                Function 0040558F Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetDlgItem.USER32(?,00000403), ref: 004055ED
                                                                                                                                                                • GetDlgItem.USER32(?,000003EE), ref: 004055FC
                                                                                                                                                                • GetClientRect.USER32(?,?), ref: 00405639
                                                                                                                                                                • GetSystemMetrics.USER32(00000002), ref: 00405640
                                                                                                                                                                • SendMessageW.USER32(?,00001061,00000000,?), ref: 00405661
                                                                                                                                                                • SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405672
                                                                                                                                                                • SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405685
                                                                                                                                                                • SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405693
                                                                                                                                                                • SendMessageW.USER32(?,00001024,00000000,?), ref: 004056A6
                                                                                                                                                                • ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004056C8
                                                                                                                                                                • ShowWindow.USER32(?,00000008), ref: 004056DC
                                                                                                                                                                • GetDlgItem.USER32(?,000003EC), ref: 004056FD
                                                                                                                                                                • SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040570D
                                                                                                                                                                • SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405726
                                                                                                                                                                • SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405732
                                                                                                                                                                • GetDlgItem.USER32(?,000003F8), ref: 0040560B
                                                                                                                                                                  • Part of subcall function 00404394: SendMessageW.USER32(00000028,?,00000001,004041BF), ref: 004043A2
                                                                                                                                                                • GetDlgItem.USER32(?,000003EC), ref: 0040574F
                                                                                                                                                                • CreateThread.KERNEL32(00000000,00000000,Function_00005523,00000000), ref: 0040575D
                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 00405764
                                                                                                                                                                • ShowWindow.USER32(00000000), ref: 00405788
                                                                                                                                                                • ShowWindow.USER32(?,00000008), ref: 0040578D
                                                                                                                                                                • ShowWindow.USER32(00000008), ref: 004057D7
                                                                                                                                                                • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040580B
                                                                                                                                                                • CreatePopupMenu.USER32 ref: 0040581C
                                                                                                                                                                • AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405830
                                                                                                                                                                • GetWindowRect.USER32(?,?), ref: 00405850
                                                                                                                                                                • TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405869
                                                                                                                                                                • SendMessageW.USER32(?,00001073,00000000,?), ref: 004058A1
                                                                                                                                                                • OpenClipboard.USER32(00000000), ref: 004058B1
                                                                                                                                                                • EmptyClipboard.USER32 ref: 004058B7
                                                                                                                                                                • GlobalAlloc.KERNEL32(00000042,00000000), ref: 004058C3
                                                                                                                                                                • GlobalLock.KERNEL32(00000000), ref: 004058CD
                                                                                                                                                                • SendMessageW.USER32(?,00001073,00000000,?), ref: 004058E1
                                                                                                                                                                • GlobalUnlock.KERNEL32(00000000), ref: 00405901
                                                                                                                                                                • SetClipboardData.USER32(0000000D,00000000), ref: 0040590C
                                                                                                                                                                • CloseClipboard.USER32 ref: 00405912
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
                                                                                                                                                                • String ID: (7B${
                                                                                                                                                                • API String ID: 590372296-525222780
                                                                                                                                                                • Opcode ID: 1d1f977673fe441afad02026140f53aaec566053b515a361d3c8f7f727d52ca3
                                                                                                                                                                • Instruction ID: ef9837d71be30d97cad1ad5ee6bf48d4101bac37d77d0ad6e239d9f51a57dc01
                                                                                                                                                                • Opcode Fuzzy Hash: 1d1f977673fe441afad02026140f53aaec566053b515a361d3c8f7f727d52ca3
                                                                                                                                                                • Instruction Fuzzy Hash: C4B16A70900608FFDB11AFA0DD85AAE7B79FB48355F00403AFA45B61A0CB754E52DF68
                                                                                                                                                                Function 00404DCC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetDlgItem.USER32(?,000003F9), ref: 00404DE4
                                                                                                                                                                • GetDlgItem.USER32(?,00000408), ref: 00404DEF
                                                                                                                                                                • GlobalAlloc.KERNEL32(00000040,?), ref: 00404E39
                                                                                                                                                                • LoadBitmapW.USER32(0000006E), ref: 00404E4C
                                                                                                                                                                • SetWindowLongW.USER32(?,000000FC,004053C4), ref: 00404E65
                                                                                                                                                                • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404E79
                                                                                                                                                                • ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404E8B
                                                                                                                                                                • SendMessageW.USER32(?,00001109,00000002), ref: 00404EA1
                                                                                                                                                                • SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404EAD
                                                                                                                                                                • SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404EBF
                                                                                                                                                                • DeleteObject.GDI32(00000000), ref: 00404EC2
                                                                                                                                                                • SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404EED
                                                                                                                                                                • SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404EF9
                                                                                                                                                                • SendMessageW.USER32(?,00001132,00000000,?), ref: 00404F8F
                                                                                                                                                                • SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404FBA
                                                                                                                                                                • SendMessageW.USER32(?,00001132,00000000,?), ref: 00404FCE
                                                                                                                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00404FFD
                                                                                                                                                                • SetWindowLongW.USER32(?,000000F0,00000000), ref: 0040500B
                                                                                                                                                                • ShowWindow.USER32(?,00000005), ref: 0040501C
                                                                                                                                                                • SendMessageW.USER32(?,00000419,00000000,?), ref: 00405119
                                                                                                                                                                • SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040517E
                                                                                                                                                                • SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405193
                                                                                                                                                                • SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004051B7
                                                                                                                                                                • SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004051D7
                                                                                                                                                                • ImageList_Destroy.COMCTL32(?), ref: 004051EC
                                                                                                                                                                • GlobalFree.KERNEL32(?), ref: 004051FC
                                                                                                                                                                • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405275
                                                                                                                                                                • SendMessageW.USER32(?,00001102,?,?), ref: 0040531E
                                                                                                                                                                • SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040532D
                                                                                                                                                                • InvalidateRect.USER32(?,00000000,00000001), ref: 0040534D
                                                                                                                                                                • ShowWindow.USER32(?,00000000), ref: 0040539B
                                                                                                                                                                • GetDlgItem.USER32(?,000003FE), ref: 004053A6
                                                                                                                                                                • ShowWindow.USER32(00000000), ref: 004053AD
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
                                                                                                                                                                • String ID: $M$N
                                                                                                                                                                • API String ID: 1638840714-813528018
                                                                                                                                                                • Opcode ID: fb644b25ca39ae204efa7e1d1243337108994715b0d322cb34e58838b66aab8b
                                                                                                                                                                • Instruction ID: 7f687e55a7f93217ddba54fde82f382d197ef8b4c31ab339cf60f2545021b201
                                                                                                                                                                • Opcode Fuzzy Hash: fb644b25ca39ae204efa7e1d1243337108994715b0d322cb34e58838b66aab8b
                                                                                                                                                                • Instruction Fuzzy Hash: DD028DB0A00609EFDF209F94CD85AAE7BB5FB44354F10807AE611BA2E0C7798D52CF58
                                                                                                                                                                Function 00404850 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 275stringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetDlgItem.USER32(?,000003FB), ref: 0040489F
                                                                                                                                                                • SetWindowTextW.USER32(00000000,?), ref: 004048C9
                                                                                                                                                                • SHBrowseForFolderW.SHELL32(?), ref: 0040497A
                                                                                                                                                                • CoTaskMemFree.OLE32(00000000), ref: 00404985
                                                                                                                                                                • lstrcmpiW.KERNEL32("C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe" https://www.bitcomet.com/client/install-stats/?l=en_us&file=Bit,00423728,00000000,?,?), ref: 004049B7
                                                                                                                                                                • lstrcatW.KERNEL32(?,"C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe" https://www.bitcomet.com/client/install-stats/?l=en_us&file=Bit), ref: 004049C3
                                                                                                                                                                • SetDlgItemTextW.USER32(?,000003FB,?), ref: 004049D5
                                                                                                                                                                  • Part of subcall function 00405A32: GetDlgItemTextW.USER32(?,?,00000400,00404A0C), ref: 00405A45
                                                                                                                                                                  • Part of subcall function 0040667C: CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe" /S,00403480,C:\Users\user\AppData\Local\Temp\,74DF3420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
                                                                                                                                                                  • Part of subcall function 0040667C: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
                                                                                                                                                                  • Part of subcall function 0040667C: CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe" /S,00403480,C:\Users\user\AppData\Local\Temp\,74DF3420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
                                                                                                                                                                  • Part of subcall function 0040667C: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe" /S,00403480,C:\Users\user\AppData\Local\Temp\,74DF3420,004036EF,?,00000006,00000008,0000000A), ref: 00406706
                                                                                                                                                                • GetDiskFreeSpaceW.KERNEL32(004216F8,?,?,0000040F,?,004216F8,004216F8,?,00000001,004216F8,?,?,000003FB,?), ref: 00404A98
                                                                                                                                                                • MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404AB3
                                                                                                                                                                  • Part of subcall function 00404C0C: lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
                                                                                                                                                                  • Part of subcall function 00404C0C: wsprintfW.USER32 ref: 00404CB6
                                                                                                                                                                  • Part of subcall function 00404C0C: SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9
                                                                                                                                                                Strings
                                                                                                                                                                • "C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe" https://www.bitcomet.com/client/install-stats/?l=en_us&file=Bit, xrefs: 004049B1, 004049B6, 004049C1
                                                                                                                                                                • (7B, xrefs: 0040494D
                                                                                                                                                                • C:\Program Files\BitComet, xrefs: 004049A0
                                                                                                                                                                • A, xrefs: 00404973
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
                                                                                                                                                                • String ID: "C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe" https://www.bitcomet.com/client/install-stats/?l=en_us&file=Bit$(7B$A$C:\Program Files\BitComet
                                                                                                                                                                • API String ID: 2624150263-3218351361
                                                                                                                                                                • Opcode ID: 60ed21fe2f328070877fcf4fb1291f079d9e461e65f212612ce38389da6d49e8
                                                                                                                                                                • Instruction ID: 217fbe9c53fcac7a38d38ba6b36a95d3c52d9e466bb1b0d29fe77156d884dce9
                                                                                                                                                                • Opcode Fuzzy Hash: 60ed21fe2f328070877fcf4fb1291f079d9e461e65f212612ce38389da6d49e8
                                                                                                                                                                • Instruction Fuzzy Hash: 01A161F1A00205ABDB11EFA5C985AAF77B8EF84315F10803BF611B62D1D77C9A418B6D
                                                                                                                                                                Function 00402868 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402877
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FileFindFirst
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1974802433-0
                                                                                                                                                                • Opcode ID: 6fd2962910cdf18594a7907c322fc030c9e7a26b232b9d9b5d327205302d7dac
                                                                                                                                                                • Instruction ID: e6f127318fd58302517648c6e406f49d0db104963aa8d987e753e5cb7f87edca
                                                                                                                                                                • Opcode Fuzzy Hash: 6fd2962910cdf18594a7907c322fc030c9e7a26b232b9d9b5d327205302d7dac
                                                                                                                                                                • Instruction Fuzzy Hash: EDF08271A14104EBDB10DBA4DA499AEB378EF14314F60467BF545F21E0DBB45D809B2A
                                                                                                                                                                Function 00403E86 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346windowstringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403EC2
                                                                                                                                                                • ShowWindow.USER32(?), ref: 00403EDF
                                                                                                                                                                • DestroyWindow.USER32 ref: 00403EF3
                                                                                                                                                                • SetWindowLongW.USER32(?,00000000,00000000), ref: 00403F0F
                                                                                                                                                                • GetDlgItem.USER32(?,?), ref: 00403F30
                                                                                                                                                                • SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403F44
                                                                                                                                                                • IsWindowEnabled.USER32(00000000), ref: 00403F4B
                                                                                                                                                                • GetDlgItem.USER32(?,00000001), ref: 00403FF9
                                                                                                                                                                • GetDlgItem.USER32(?,00000002), ref: 00404003
                                                                                                                                                                • SetClassLongW.USER32(?,000000F2,?), ref: 0040401D
                                                                                                                                                                • SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040406E
                                                                                                                                                                • GetDlgItem.USER32(?,00000003), ref: 00404114
                                                                                                                                                                • ShowWindow.USER32(00000000,?), ref: 00404135
                                                                                                                                                                • EnableWindow.USER32(?,?), ref: 00404147
                                                                                                                                                                • EnableWindow.USER32(?,?), ref: 00404162
                                                                                                                                                                • GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00404178
                                                                                                                                                                • EnableMenuItem.USER32(00000000), ref: 0040417F
                                                                                                                                                                • SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00404197
                                                                                                                                                                • SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004041AA
                                                                                                                                                                • lstrlenW.KERNEL32(00423728,?,00423728,00000000), ref: 004041D4
                                                                                                                                                                • SetWindowTextW.USER32(?,00423728), ref: 004041E8
                                                                                                                                                                • ShowWindow.USER32(?,0000000A), ref: 0040431C
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
                                                                                                                                                                • String ID: (7B
                                                                                                                                                                • API String ID: 184305955-3251261122
                                                                                                                                                                • Opcode ID: 42b69af187e06dbbd4ac4a762ea4715538cd3e369663267481291b142cb35f12
                                                                                                                                                                • Instruction ID: 1e1a27d6975204c591228116fe5edee23a209105d2649c04e919f1d7e5095d09
                                                                                                                                                                • Opcode Fuzzy Hash: 42b69af187e06dbbd4ac4a762ea4715538cd3e369663267481291b142cb35f12
                                                                                                                                                                • Instruction Fuzzy Hash: 6FC1A2B1644200FBDB216F61EE85D2A3BB8EB94706F40053EFA41B11F1CB7958529B6D
                                                                                                                                                                Function 0040451E Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CheckDlgButton.USER32(?,-0000040A,00000001), ref: 004045BC
                                                                                                                                                                • GetDlgItem.USER32(?,000003E8), ref: 004045D0
                                                                                                                                                                • SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004045ED
                                                                                                                                                                • GetSysColor.USER32(?), ref: 004045FE
                                                                                                                                                                • SendMessageW.USER32(00000000,00000443,00000000,?), ref: 0040460C
                                                                                                                                                                • SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040461A
                                                                                                                                                                • lstrlenW.KERNEL32(?), ref: 0040461F
                                                                                                                                                                • SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040462C
                                                                                                                                                                • SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404641
                                                                                                                                                                • GetDlgItem.USER32(?,0000040A), ref: 0040469A
                                                                                                                                                                • SendMessageW.USER32(00000000), ref: 004046A1
                                                                                                                                                                • GetDlgItem.USER32(?,000003E8), ref: 004046CC
                                                                                                                                                                • SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 0040470F
                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F02), ref: 0040471D
                                                                                                                                                                • SetCursor.USER32(00000000), ref: 00404720
                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F00), ref: 00404739
                                                                                                                                                                • SetCursor.USER32(00000000), ref: 0040473C
                                                                                                                                                                • SendMessageW.USER32(00000111,00000001,00000000), ref: 0040476B
                                                                                                                                                                • SendMessageW.USER32(00000010,00000000,00000000), ref: 0040477D
                                                                                                                                                                Strings
                                                                                                                                                                • "C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe" https://www.bitcomet.com/client/install-stats/?l=en_us&file=Bit, xrefs: 004046FB
                                                                                                                                                                • N, xrefs: 004046BA
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
                                                                                                                                                                • String ID: "C:\Users\user\AppData\Local\Temp\nscA1E4.tmp\BitComet_stats.exe" https://www.bitcomet.com/client/install-stats/?l=en_us&file=Bit$N
                                                                                                                                                                • API String ID: 3103080414-3849266147
                                                                                                                                                                • Opcode ID: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
                                                                                                                                                                • Instruction ID: 26ae409e5f73424340e4bb55f347a499eb46e427c8d4328441e026d38e95c6c2
                                                                                                                                                                • Opcode Fuzzy Hash: c2d943e7d3074a80d89972f065d7b0d6c6867904808fb573d17a53c74c23d30b
                                                                                                                                                                • Instruction Fuzzy Hash: 4B6173B1900209BFDB109F60DD85EAA7B69FB84314F00853AFB05772E0D7789D52CB58
                                                                                                                                                                Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
                                                                                                                                                                • BeginPaint.USER32(?,?), ref: 00401047
                                                                                                                                                                • GetClientRect.USER32(?,?), ref: 0040105B
                                                                                                                                                                • CreateBrushIndirect.GDI32(00000000), ref: 004010CF
                                                                                                                                                                • FillRect.USER32(00000000,?,00000000), ref: 004010E4
                                                                                                                                                                • DeleteObject.GDI32(?), ref: 004010ED
                                                                                                                                                                • CreateFontIndirectW.GDI32(?), ref: 00401105
                                                                                                                                                                • SetBkMode.GDI32(00000000,00000001), ref: 00401126
                                                                                                                                                                • SetTextColor.GDI32(00000000,000000FF), ref: 00401130
                                                                                                                                                                • SelectObject.GDI32(00000000,?), ref: 00401140
                                                                                                                                                                • DrawTextW.USER32(00000000,00429240,000000FF,00000010,00000820), ref: 00401156
                                                                                                                                                                • SelectObject.GDI32(00000000,00000000), ref: 00401160
                                                                                                                                                                • DeleteObject.GDI32(?), ref: 00401165
                                                                                                                                                                • EndPaint.USER32(?,?), ref: 0040116E
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
                                                                                                                                                                • String ID: F
                                                                                                                                                                • API String ID: 941294808-1304234792
                                                                                                                                                                • Opcode ID: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
                                                                                                                                                                • Instruction ID: b35030fe9107d9a8359b932f7918d2348922827c9ca57aaae851fe5b21190c6b
                                                                                                                                                                • Opcode Fuzzy Hash: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
                                                                                                                                                                • Instruction Fuzzy Hash: 92418A71800249AFCF058FA5DE459AFBBB9FF44310F00842AF991AA1A0C738E955DFA4
                                                                                                                                                                Function 00406034 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,004061CF,?,?), ref: 0040606F
                                                                                                                                                                • GetShortPathNameW.KERNEL32(?,00426DC8,00000400), ref: 00406078
                                                                                                                                                                  • Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
                                                                                                                                                                  • Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85
                                                                                                                                                                • GetShortPathNameW.KERNEL32(?,004275C8,00000400), ref: 00406095
                                                                                                                                                                • wsprintfA.USER32 ref: 004060B3
                                                                                                                                                                • GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,00000004,004275C8,?,?,?,?,?), ref: 004060EE
                                                                                                                                                                • GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 004060FD
                                                                                                                                                                • lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406135
                                                                                                                                                                • SetFilePointer.KERNEL32(0040A590,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A590,00000000,[Rename],00000000,00000000,00000000), ref: 0040618B
                                                                                                                                                                • GlobalFree.KERNEL32(00000000), ref: 0040619C
                                                                                                                                                                • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004061A3
                                                                                                                                                                  • Part of subcall function 00405EDE: GetFileAttributesW.KERNELBASE(00000003,00402F73,C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe,80000000,00000003), ref: 00405EE2
                                                                                                                                                                  • Part of subcall function 00405EDE: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
                                                                                                                                                                • String ID: %ls=%ls$[Rename]
                                                                                                                                                                • API String ID: 2171350718-461813615
                                                                                                                                                                • Opcode ID: e35d52778e3551e7046882a86a607d9f87e6bbb1e98b27cedc4e65ae0c3bcd27
                                                                                                                                                                • Instruction ID: 8c4bc4cab4d3408e43c29de3b383fd3cef376d344e04ab2aaf2f470794b42cbb
                                                                                                                                                                • Opcode Fuzzy Hash: e35d52778e3551e7046882a86a607d9f87e6bbb1e98b27cedc4e65ae0c3bcd27
                                                                                                                                                                • Instruction Fuzzy Hash: 34313770200719BFD2206B619D48F6B3A6CEF45704F16043EFA46FA2D3DA3C99158ABD
                                                                                                                                                                Function 0040667C Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe" /S,00403480,C:\Users\user\AppData\Local\Temp\,74DF3420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
                                                                                                                                                                • CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
                                                                                                                                                                • CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe" /S,00403480,C:\Users\user\AppData\Local\Temp\,74DF3420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
                                                                                                                                                                • CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe" /S,00403480,C:\Users\user\AppData\Local\Temp\,74DF3420,004036EF,?,00000006,00000008,0000000A), ref: 00406706
                                                                                                                                                                Strings
                                                                                                                                                                • *?|<>/":, xrefs: 004066CE
                                                                                                                                                                • C:\Users\user\AppData\Local\Temp\, xrefs: 0040667D, 00406682
                                                                                                                                                                • "C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe" /S, xrefs: 0040667C
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Char$Next$Prev
                                                                                                                                                                • String ID: "C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe" /S$*?|<>/":$C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                • API String ID: 589700163-815249525
                                                                                                                                                                • Opcode ID: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
                                                                                                                                                                • Instruction ID: ccb021e8c97aa0e4e9f296cc8cc4b0d2e06c32826977e33acd3911ee1a404cd3
                                                                                                                                                                • Opcode Fuzzy Hash: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
                                                                                                                                                                • Instruction Fuzzy Hash: E011C82580061295DB302B548C44B77A2E8EF55764F52843FE985B32C1EB7D5CE28ABD
                                                                                                                                                                Function 004043C6 Relevance: 12.1, APIs: 8, Instructions: 68COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetWindowLongW.USER32(?,000000EB), ref: 004043E3
                                                                                                                                                                • GetSysColor.USER32(00000000), ref: 00404421
                                                                                                                                                                • SetTextColor.GDI32(?,00000000), ref: 0040442D
                                                                                                                                                                • SetBkMode.GDI32(?,?), ref: 00404439
                                                                                                                                                                • GetSysColor.USER32(?), ref: 0040444C
                                                                                                                                                                • SetBkColor.GDI32(?,?), ref: 0040445C
                                                                                                                                                                • DeleteObject.GDI32(?), ref: 00404476
                                                                                                                                                                • CreateBrushIndirect.GDI32(?), ref: 00404480
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2320649405-0
                                                                                                                                                                • Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
                                                                                                                                                                • Instruction ID: 4d8d1a64c5805e8a020b3744e793f2033a9a6b6b0a681029562fed9dd316a9da
                                                                                                                                                                • Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
                                                                                                                                                                • Instruction Fuzzy Hash: 722131715007049BCB319F68D948B5BBBF8AF81714B148A2EEE96E26E0D738D944CB54
                                                                                                                                                                Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ReadFile.KERNEL32(?,?,?,?), ref: 004026B6
                                                                                                                                                                • MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004026F1
                                                                                                                                                                • SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402714
                                                                                                                                                                • MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040272A
                                                                                                                                                                  • Part of subcall function 00405FBF: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405FD5
                                                                                                                                                                • SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D6
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$Pointer$ByteCharMultiWide$Read
                                                                                                                                                                • String ID: 9
                                                                                                                                                                • API String ID: 163830602-2366072709
                                                                                                                                                                • Opcode ID: cadc99d36448674c458fec809f66667da68abd58cfb7d9264b13fa75ded684dc
                                                                                                                                                                • Instruction ID: add249696b334c0fceafe0529c612de3b1c59f5eaafd60b3ba6c21ea99dd66a9
                                                                                                                                                                • Opcode Fuzzy Hash: cadc99d36448674c458fec809f66667da68abd58cfb7d9264b13fa75ded684dc
                                                                                                                                                                • Instruction Fuzzy Hash: FD510A74D10219AEDF21DF95DA88AAEB779FF04304F50443BE901B72D0D7B89982CB59
                                                                                                                                                                Function 00405450 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
                                                                                                                                                                • lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
                                                                                                                                                                • lstrcatW.KERNEL32(00422708,00402F08), ref: 004054AB
                                                                                                                                                                • SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
                                                                                                                                                                • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
                                                                                                                                                                • SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
                                                                                                                                                                • SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageSend$lstrlen$TextWindowlstrcat
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2531174081-0
                                                                                                                                                                • Opcode ID: d8bd542d8f5d0add287beae510a16995646733a1dc03fc5179ed0d48c47eb8dc
                                                                                                                                                                • Instruction ID: e73fa1987b6059f35b704de59c80f6892b54c3d1ee51518932a2041d94d0b0cb
                                                                                                                                                                • Opcode Fuzzy Hash: d8bd542d8f5d0add287beae510a16995646733a1dc03fc5179ed0d48c47eb8dc
                                                                                                                                                                • Instruction Fuzzy Hash: BE21A171900558BACB119F95DD84ACFBFB5EF84314F10803AF904B22A1C3798A91CFA8
                                                                                                                                                                Function 00402E8E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • DestroyWindow.USER32(00000000,00000000), ref: 00402EA9
                                                                                                                                                                • GetTickCount.KERNEL32 ref: 00402EC7
                                                                                                                                                                • wsprintfW.USER32 ref: 00402EF5
                                                                                                                                                                  • Part of subcall function 00405450: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
                                                                                                                                                                  • Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
                                                                                                                                                                  • Part of subcall function 00405450: lstrcatW.KERNEL32(00422708,00402F08), ref: 004054AB
                                                                                                                                                                  • Part of subcall function 00405450: SetWindowTextW.USER32(00422708,00422708), ref: 004054BD
                                                                                                                                                                  • Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
                                                                                                                                                                  • Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
                                                                                                                                                                  • Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B
                                                                                                                                                                • CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402F19
                                                                                                                                                                • ShowWindow.USER32(00000000,00000005), ref: 00402F27
                                                                                                                                                                  • Part of subcall function 00402E72: MulDiv.KERNEL32(00000000,00000064,0012956F), ref: 00402E87
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
                                                                                                                                                                • String ID: ... %d%%
                                                                                                                                                                • API String ID: 722711167-2449383134
                                                                                                                                                                • Opcode ID: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
                                                                                                                                                                • Instruction ID: c65c9f61eb329069142d3a49436c3393aeffd9891ae55f37d91fa0e4ac25720a
                                                                                                                                                                • Opcode Fuzzy Hash: c40ddff33436de44b244b2b19f9e8da7546f4e0328de08243a0837e5050f2c6b
                                                                                                                                                                • Instruction Fuzzy Hash: 1A016170941614EBC7226B60EE4DA9B7B68BB01745B50413FF841F12E0CAB84459DBEE
                                                                                                                                                                Function 00404D1A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404D35
                                                                                                                                                                • GetMessagePos.USER32 ref: 00404D3D
                                                                                                                                                                • ScreenToClient.USER32(?,?), ref: 00404D57
                                                                                                                                                                • SendMessageW.USER32(?,00001111,00000000,?), ref: 00404D69
                                                                                                                                                                • SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404D8F
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Message$Send$ClientScreen
                                                                                                                                                                • String ID: f
                                                                                                                                                                • API String ID: 41195575-1993550816
                                                                                                                                                                • Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
                                                                                                                                                                • Instruction ID: ac2b37e4453cd55ff3643614bd1240a9a451636028a825994647dd398b99f398
                                                                                                                                                                • Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
                                                                                                                                                                • Instruction Fuzzy Hash: 23015E71940218BADB00DB94DD85FFEBBBCAF95711F10412BBA50F62D0D7B499018BA4
                                                                                                                                                                Function 00402DF3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E11
                                                                                                                                                                • wsprintfW.USER32 ref: 00402E45
                                                                                                                                                                • SetWindowTextW.USER32(?,?), ref: 00402E55
                                                                                                                                                                • SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E67
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Text$ItemTimerWindowwsprintf
                                                                                                                                                                • String ID: unpacking data: %d%%$verifying installer: %d%%
                                                                                                                                                                • API String ID: 1451636040-1158693248
                                                                                                                                                                • Opcode ID: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
                                                                                                                                                                • Instruction ID: 1bfa7b94c56a1c823be81e007cf4dd9dcc28a4463181553f30e61efe61dd31fb
                                                                                                                                                                • Opcode Fuzzy Hash: a591fce2f88080881549ac7e7473da6278debd618655821d08f98b44133a3158
                                                                                                                                                                • Instruction Fuzzy Hash: 30F0317064020CABDF206F60DD4ABEE3B69EB40319F00803AFA45B51D0DBB999598F99
                                                                                                                                                                Function 00404C0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
                                                                                                                                                                • wsprintfW.USER32 ref: 00404CB6
                                                                                                                                                                • SetDlgItemTextW.USER32(?,00423728), ref: 00404CC9
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ItemTextlstrlenwsprintf
                                                                                                                                                                • String ID: %u.%u%s%s$(7B
                                                                                                                                                                • API String ID: 3540041739-1320723960
                                                                                                                                                                • Opcode ID: c06007edea0c83b5e0931fd45a2cd42dabd82a11b0b4461ae96ab8921206da46
                                                                                                                                                                • Instruction ID: eedca0a42859d703ec1426aadcab00983e9769f6aa36ce56d5d2522b0312c54d
                                                                                                                                                                • Opcode Fuzzy Hash: c06007edea0c83b5e0931fd45a2cd42dabd82a11b0b4461ae96ab8921206da46
                                                                                                                                                                • Instruction Fuzzy Hash: A711D873A0412837EB00556DAC45EDE3298EB85374F254237FA26F31D1D9798C6282E8
                                                                                                                                                                Function 00401DB9 Relevance: 7.5, APIs: 5, Instructions: 43COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetDC.USER32(?), ref: 00401DBC
                                                                                                                                                                • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
                                                                                                                                                                • MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
                                                                                                                                                                • ReleaseDC.USER32(?,00000000), ref: 00401DEF
                                                                                                                                                                • CreateFontIndirectW.GDI32(0040CDD8), ref: 00401E3E
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CapsCreateDeviceFontIndirectRelease
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3808545654-0
                                                                                                                                                                • Opcode ID: e8aeef341752f35f6f278e7796ab08014b9ac4723c71950966d24e93e9008032
                                                                                                                                                                • Instruction ID: 863f18fc6204ba506076eb1f746ada73c94881a68b515e1873f2d1072bd1cf43
                                                                                                                                                                • Opcode Fuzzy Hash: e8aeef341752f35f6f278e7796ab08014b9ac4723c71950966d24e93e9008032
                                                                                                                                                                • Instruction Fuzzy Hash: 15017171944240EFE701ABB4AF8ABD97FB4AF55301F10457EE242F61E2CA7804459F2D
                                                                                                                                                                Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetDlgItem.USER32(?,?), ref: 00401D63
                                                                                                                                                                • GetClientRect.USER32(00000000,?), ref: 00401D70
                                                                                                                                                                • LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
                                                                                                                                                                • SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
                                                                                                                                                                • DeleteObject.GDI32(00000000), ref: 00401DAE
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ClientDeleteImageItemLoadMessageObjectRectSend
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1849352358-0
                                                                                                                                                                • Opcode ID: f8e0c1d3071f89bffdcd2d635822fb410905a1edc8d2ce6cb8a0a09a78f20d84
                                                                                                                                                                • Instruction ID: 8bbc6a183a468c813578a114873fb97f9d5ca0b11dae6a70aa3aa56fe52826a6
                                                                                                                                                                • Opcode Fuzzy Hash: f8e0c1d3071f89bffdcd2d635822fb410905a1edc8d2ce6cb8a0a09a78f20d84
                                                                                                                                                                • Instruction Fuzzy Hash: 4BF0FF72A04518AFDB01DBE4DF88CEEB7BCEB48301B14047AF641F61A0CA749D519B38
                                                                                                                                                                Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
                                                                                                                                                                • SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MessageSend$Timeout
                                                                                                                                                                • String ID: !
                                                                                                                                                                • API String ID: 1777923405-2657877971
                                                                                                                                                                • Opcode ID: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
                                                                                                                                                                • Instruction ID: ef61c68cd4a6cc3a6f3726d4b558d534156d03c1c75d5f5b51cfe904c604fa23
                                                                                                                                                                • Opcode Fuzzy Hash: 204806375d4f16312a37781d02af86e184349cdc68ded53cac09897120414cdc
                                                                                                                                                                • Instruction Fuzzy Hash: A621B471948209AEEF049FA5DA4AABD7BB4EB44304F14443EF605B61D0D7B845409B18
                                                                                                                                                                Function 00402598 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69stringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • WideCharToMultiByte.KERNEL32(?,?,0040B5D8,000000FF,C:\Users\user\AppData\Local\Temp\nscA1E4.tmp,00000400,?,?,00000021), ref: 004025E8
                                                                                                                                                                • lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nscA1E4.tmp,?,?,0040B5D8,000000FF,C:\Users\user\AppData\Local\Temp\nscA1E4.tmp,00000400,?,?,00000021), ref: 004025F3
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ByteCharMultiWidelstrlen
                                                                                                                                                                • String ID: C:\Users\user\AppData\Local\Temp\nscA1E4.tmp
                                                                                                                                                                • API String ID: 3109718747-3719291795
                                                                                                                                                                • Opcode ID: 74dacd12b4a24cfb73fd48792ba77bb428cc6d1ed50c00179c1822de178a8f1b
                                                                                                                                                                • Instruction ID: c13fbae436403556d6c48d38c5ac6db5007ae9437622b5a65b164b2cac9ab4a1
                                                                                                                                                                • Opcode Fuzzy Hash: 74dacd12b4a24cfb73fd48792ba77bb428cc6d1ed50c00179c1822de178a8f1b
                                                                                                                                                                • Instruction Fuzzy Hash: FB110B72A00301BADB106BB18E8999F7664AF44359F20443BF502F21D0D9FC89416B5E
                                                                                                                                                                Function 00405CBD Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403492,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004036EF,?,00000006,00000008,0000000A), ref: 00405CC3
                                                                                                                                                                • CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403492,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004036EF,?,00000006,00000008,0000000A), ref: 00405CCD
                                                                                                                                                                • lstrcatW.KERNEL32(?,0040A014), ref: 00405CDF
                                                                                                                                                                Strings
                                                                                                                                                                • C:\Users\user\AppData\Local\Temp\, xrefs: 00405CBD
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CharPrevlstrcatlstrlen
                                                                                                                                                                • String ID: C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                • API String ID: 2659869361-3081826266
                                                                                                                                                                • Opcode ID: cc3b6fad2320eb0d125534955cb1fe8af3638bf69e103b669ecb1462063790d4
                                                                                                                                                                • Instruction ID: 595fb0ef6d3bfc82903baa2f142a0de03b6946227050b98ce465681b6cfad29b
                                                                                                                                                                • Opcode Fuzzy Hash: cc3b6fad2320eb0d125534955cb1fe8af3638bf69e103b669ecb1462063790d4
                                                                                                                                                                • Instruction Fuzzy Hash: AED0A771101630AAC111AB448D04CDF63ACEE45304342003BF601B70A2CB7C1D6287FD
                                                                                                                                                                Function 004053C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • IsWindowVisible.USER32(?), ref: 004053F3
                                                                                                                                                                • CallWindowProcW.USER32(?,?,?,?), ref: 00405444
                                                                                                                                                                  • Part of subcall function 004043AB: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004043BD
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Window$CallMessageProcSendVisible
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3748168415-3916222277
                                                                                                                                                                • Opcode ID: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
                                                                                                                                                                • Instruction ID: 343f6187318c33bb175646012d6cb398530476c6c15fe8dd96994d534b9a6b17
                                                                                                                                                                • Opcode Fuzzy Hash: 36caebe1fe8aa1eff7ff321662443c514d6827d4f2801b7b393fcb4226acda68
                                                                                                                                                                • Instruction Fuzzy Hash: CC0171B1200609ABDF305F11DD84B9B3666EBD4356F508037FA00761E1C77A8DD29A6E
                                                                                                                                                                Function 00405D09 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • lstrlenW.KERNEL32(80000000,C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp,00402F9C,C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp,C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp,C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe,C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe,80000000,00000003), ref: 00405D0F
                                                                                                                                                                • CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp,00402F9C,C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp,C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp,C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe,C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\BitComet_2.08a_setup.exe,80000000,00000003), ref: 00405D1F
                                                                                                                                                                Strings
                                                                                                                                                                • C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp, xrefs: 00405D09
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CharPrevlstrlen
                                                                                                                                                                • String ID: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp
                                                                                                                                                                • API String ID: 2709904686-3891245195
                                                                                                                                                                • Opcode ID: e4f7a16c0d3aeb27420e4918e5816bacf7b9900a4c75110623d7ea7fd9e9117e
                                                                                                                                                                • Instruction ID: 65148869c9b5617484fe42b3676c909fd92059a2a8224d2a454660f99163d925
                                                                                                                                                                • Opcode Fuzzy Hash: e4f7a16c0d3aeb27420e4918e5816bacf7b9900a4c75110623d7ea7fd9e9117e
                                                                                                                                                                • Instruction Fuzzy Hash: A3D0A7B7410920EAD3126B04DC04D9F73ACEF51300B46843BE840A7171D7785CD18BEC
                                                                                                                                                                Function 00405E43 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
                                                                                                                                                                • lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405E6B
                                                                                                                                                                • CharNextA.USER32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7C
                                                                                                                                                                • lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000005.00000002.2245178626.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000005.00000002.2244979021.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245378494.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000425000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000427000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.000000000042B000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000435000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2245578736.0000000000441000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                • Associated: 00000005.00000002.2246743169.000000000044A000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BitComet_2.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: lstrlen$CharNextlstrcmpi
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 190613189-0
                                                                                                                                                                • Opcode ID: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
                                                                                                                                                                • Instruction ID: 3eb9f18af2c16f81f4dc7877ab3147293eaebe45f2d41041cd024b5e05e36bdf
                                                                                                                                                                • Opcode Fuzzy Hash: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
                                                                                                                                                                • Instruction Fuzzy Hash: 4AF0C831100514AFC7029B94DD4099FBBA8DF06354B25407AE844FB211D634DF01AB98

                                                                                                                                                                Non-executed Functions

                                                                                                                                                                Function 00401000 Relevance: 7.6, Strings: 6, Instructions: 129COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000007.00000002.2219985855.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000007.00000002.2219964268.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                • Associated: 00000007.00000002.2220151186.0000000000596000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                • Associated: 00000007.00000002.2220244069.0000000000677000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                • Associated: 00000007.00000002.2220272030.0000000000679000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                • Associated: 00000007.00000002.2220294974.000000000067B000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                • Associated: 00000007.00000002.2220294974.0000000000680000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                • Associated: 00000007.00000002.2220339740.0000000000682000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_7_2_400000_BitCometService.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID: Auth$Genu$cAMD$enti$ineI$ntel
                                                                                                                                                                • API String ID: 0-1714976780
                                                                                                                                                                • Opcode ID: c77623a033a8abfacda9f66ad4af76de5be2dd884c722bfa4f30fc1e450f6a10
                                                                                                                                                                • Instruction ID: c59423c1d96c5e2f9c2686e45b52b7fbe6d71f2a21420d71dddde3701b428d54
                                                                                                                                                                • Opcode Fuzzy Hash: c77623a033a8abfacda9f66ad4af76de5be2dd884c722bfa4f30fc1e450f6a10
                                                                                                                                                                • Instruction Fuzzy Hash: A1314C77B145560BEB3C98789C843AE20835359334F2AC73BD676EB6E4E47DCC814198
                                                                                                                                                                Function 00401440 Relevance: .0, Instructions: 46COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000007.00000002.2219985855.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000007.00000002.2219964268.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                • Associated: 00000007.00000002.2220151186.0000000000596000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                • Associated: 00000007.00000002.2220244069.0000000000677000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                • Associated: 00000007.00000002.2220272030.0000000000679000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                • Associated: 00000007.00000002.2220294974.000000000067B000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                • Associated: 00000007.00000002.2220294974.0000000000680000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                • Associated: 00000007.00000002.2220339740.0000000000682000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_7_2_400000_BitCometService.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: 2da9b68ae21d7da327531f1b00c3901689e103dcf450733b6abf74322a886aec
                                                                                                                                                                • Instruction ID: dc411a64e3c73bd228d32a490a76efacea924a4573c5897d61d91e0bac13f7f4
                                                                                                                                                                • Opcode Fuzzy Hash: 2da9b68ae21d7da327531f1b00c3901689e103dcf450733b6abf74322a886aec
                                                                                                                                                                • Instruction Fuzzy Hash: 6A01D1323083524FC700CD3C9A40796FBEAEB96368F194A79F409E32AAD2799D158790
                                                                                                                                                                Function 004013D0 Relevance: .0, Instructions: 34COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000007.00000002.2219985855.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000007.00000002.2219964268.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                • Associated: 00000007.00000002.2220151186.0000000000596000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                • Associated: 00000007.00000002.2220244069.0000000000677000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                • Associated: 00000007.00000002.2220272030.0000000000679000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                • Associated: 00000007.00000002.2220294974.000000000067B000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                • Associated: 00000007.00000002.2220294974.0000000000680000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                • Associated: 00000007.00000002.2220339740.0000000000682000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_7_2_400000_BitCometService.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: b3c66d063c414dce9f4c6c17efb052cc7cce3d4e7c6ea25b824a8b16a68bfe09
                                                                                                                                                                • Instruction ID: daa30563b6241f8b0c41b551014eb33d8f28dbacc7f24aaa78fe62835a08a5e4
                                                                                                                                                                • Opcode Fuzzy Hash: b3c66d063c414dce9f4c6c17efb052cc7cce3d4e7c6ea25b824a8b16a68bfe09
                                                                                                                                                                • Instruction Fuzzy Hash: 28F0BE322083228FC300CE28E540693FBE9EB963A8F110A76F009E7265C7399E01CBD0

                                                                                                                                                                Execution Graph

                                                                                                                                                                Execution Coverage:13.6%
                                                                                                                                                                Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                Signature Coverage:4.5%
                                                                                                                                                                Total number of Nodes:1465
                                                                                                                                                                Total number of Limit Nodes:25
                                                                                                                                                                execution_graph 6956 40a4c2 6957 40a502 6956->6957 6959 40a4ca DeleteCriticalSection 6956->6959 6959->6957 6960 404cc3 6966 404bc1 6960->6966 6963 401e3a 18 API calls 6964 404cf0 SetWindowLongW 6963->6964 6965 404d0b 6964->6965 6967 404bd2 EnterCriticalSection 6966->6967 6968 404bce 6966->6968 6969 404bee GetCurrentThreadId 6967->6969 6970 404bf6 6967->6970 6968->6963 6968->6965 6969->6970 6971 40145c LeaveCriticalSection 6970->6971 6971->6968 7248 4023c6 7249 4023da GetClientRect BitBlt DeleteDC 7248->7249 7250 40241e 7248->7250 7251 402421 ReleaseDC 7249->7251 7250->7251 6482 40244c InvalidateRgn 6483 402e52 6484 402e82 6483->6484 6485 402e78 6483->6485 6484->6485 6487 402e9c GetStockObject 6484->6487 6486 40ab6a __invoke_watson 5 API calls 6485->6486 6488 402fb3 6486->6488 6489 402ecb GetObjectW 6487->6489 6490 402ead GetStockObject 6487->6490 6491 402f15 6489->6491 6490->6489 6492 402eb5 6490->6492 6493 402f21 GetDC 6491->6493 6494 402f3f GetDesktopWindow GetDC 6491->6494 6495 401d2c GetLastError 6492->6495 6493->6492 6496 402f2e GetDeviceCaps 6493->6496 6494->6492 6497 402f58 GetDeviceCaps GetDesktopWindow 6494->6497 6498 402eba 6495->6498 6499 402f67 ReleaseDC OleCreateFontIndirect 6496->6499 6497->6499 6500 401125 HeapFree 6498->6500 6501 401125 HeapFree 6499->6501 6500->6485 6501->6485 6972 40a0d3 GetVersionExA 6973 40a106 InterlockedExchange 6972->6973 6975 40a12b 6973->6975 6976 40ab6a __invoke_watson 5 API calls 6975->6976 6977 40a135 6976->6977 7104 405f53 7107 405f28 7104->7107 7108 403691 ctype DestroyAcceleratorTable 7107->7108 7109 405f40 7108->7109 6502 403c54 6503 403c6a 6502->6503 6504 403c60 6502->6504 6503->6504 6505 401207 2 API calls 6503->6505 6506 403c93 SysFreeString 6505->6506 6508 403cb7 SysStringLen 6506->6508 6514 403cf3 SysFreeString 6506->6514 6509 403cc6 SysStringLen CoTaskMemAlloc 6508->6509 6508->6514 6511 403ce8 6509->6511 6512 403cdc SysFreeString 6509->6512 6513 401082 __VEC_memcpy 6511->6513 6512->6504 6513->6514 6514->6504 7110 407554 7111 40751f ctype 6 API calls 7110->7111 7112 40755c moneypunct 7111->7112 7252 40d5d4 RtlUnwind 6074 404dd5 6075 404ddf 6074->6075 6076 404df0 DestroyWindow 6075->6076 6077 404df7 6075->6077 6076->6077 7113 405d55 7115 405d66 7113->7115 7114 405e74 7115->7114 7116 405da6 7115->7116 7123 4058d5 7115->7123 7119 405dc7 7116->7119 7129 405937 7116->7129 7119->7114 7120 405dfc GetClientRect GetClientRect 7119->7120 7121 405e37 GetParent 7120->7121 7122 405e1a CreateAcceleratorTableW 7120->7122 7121->7114 7122->7121 7124 4058e5 7123->7124 7125 4058de 7123->7125 7126 40a687 HeapAlloc 7124->7126 7125->7116 7127 4058f6 7126->7127 7127->7125 7135 40291e 7127->7135 7130 405947 7129->7130 7134 405940 7129->7134 7131 40a687 HeapAlloc 7130->7131 7132 405958 7131->7132 7133 40291e InitializeCriticalSection 7132->7133 7132->7134 7133->7134 7134->7119 7136 401ce1 InitializeCriticalSection 7135->7136 7137 402929 7136->7137 7137->7125 6198 40aadb 6203 40ccc5 6198->6203 6204 40ccf5 GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter 6203->6204 6205 40cce8 6203->6205 6207 40cd34 6204->6207 6205->6204 6206 40aae3 6205->6206 6208 40aa2e GetCommandLineW 6206->6208 6207->6206 6209 40aa42 ExitProcess 6208->6209 6210 40aa4a 6208->6210 6226 40a559 6210->6226 6213 40aa4f 6214 40aa79 6213->6214 6215 40aa5e CharNextW 6213->6215 6218 40aa71 6214->6218 6219 40aa7f CharNextW 6214->6219 6216 40aa92 CharNextW 6215->6216 6217 40aa6c 6215->6217 6216->6218 6217->6215 6217->6218 6218->6216 6220 40aa9f GetStartupInfoW 6218->6220 6219->6218 6219->6219 6221 40aab3 GetModuleHandleA 6220->6221 6232 409ae0 6221->6232 6227 40a565 _memset __get_sse2_info 6226->6227 6228 40a579 GetVersionExA InitializeCriticalSection EnterCriticalSection GetProcessHeap 6227->6228 6229 40a5b9 6228->6229 6255 40a601 LeaveCriticalSection 6229->6255 6231 40a5f6 __get_sse2_info 6231->6213 6233 409aeb 6232->6233 6234 409b4f MessageBoxExW 6232->6234 6233->6234 6236 409afe CoInitialize DefWindowProcW 6233->6236 6235 409b67 6234->6235 6247 40a848 6235->6247 6256 406533 InitCommonControlsEx 6236->6256 6238 409b17 6257 4069f4 6238->6257 6241 40194e 14 API calls 6242 409b2e 6241->6242 6262 409a13 6242->6262 6246 409b44 CoUninitialize 6246->6235 6414 40abac 6247->6414 6249 40a854 EnterCriticalSection 6251 40a86d 6249->6251 6250 40a66d __freea HeapFree 6253 40a897 6250->6253 6251->6250 6415 40a8f1 LeaveCriticalSection DeleteCriticalSection 6253->6415 6254 40a8e6 __get_sse2_info 6254->6209 6255->6231 6256->6238 6258 406a0a 6257->6258 6259 406a12 GetCurrentThreadId 6258->6259 6261 406a25 6258->6261 6260 40a687 HeapAlloc 6259->6260 6260->6261 6261->6241 6291 4080bf EnterCriticalSection GetCurrentThreadId 6262->6291 6266 409a61 6299 4092cd 6266->6299 6269 409a6f 6304 40778f 6269->6304 6278 40a2e7 HeapFree 6281 409a87 6278->6281 6279 409ad7 6330 409280 EnterCriticalSection GetCurrentThreadId 6279->6330 6280 409acd 6329 401191 KiUserCallbackDispatcher PostQuitMessage 6280->6329 6284 40ab6a __invoke_watson 5 API calls 6281->6284 6285 409a96 6284->6285 6286 409259 6285->6286 6399 408112 EnterCriticalSection 6286->6399 6290 409270 moneypunct 6335 4076e8 6291->6335 6293 4080f5 LeaveCriticalSection 6294 40145c LeaveCriticalSection 6293->6294 6295 40810a 6294->6295 6296 4082c6 6295->6296 6340 406b20 6296->6340 6298 4082e0 6298->6266 6343 404b61 6299->6343 6375 406a4f 6304->6375 6307 4077ad 6309 40a2e7 6307->6309 6310 40a2f0 6309->6310 6311 409a7f 6309->6311 6312 40a66d __freea HeapFree 6310->6312 6311->6278 6312->6311 6313 405c5b GetDlgItem 6314 40194e 14 API calls 6313->6314 6315 405c77 6314->6315 6385 401483 6315->6385 6318 405c92 VariantInit 6319 401207 2 API calls 6318->6319 6320 405ca7 SysFreeString VariantClear 6319->6320 6322 405cd4 SetTimer 6320->6322 6323 406972 6322->6323 6326 406981 6323->6326 6324 406987 PeekMessageW 6325 4069af GetMessageW 6324->6325 6324->6326 6325->6326 6326->6324 6326->6325 6327 4069eb IsWindow 6326->6327 6328 4069cd TranslateMessage DispatchMessageW 6326->6328 6327->6279 6327->6280 6328->6326 6389 40817c 6330->6389 6333 40145c LeaveCriticalSection 6334 4092c7 6333->6334 6334->6269 6336 40a93c 3 API calls 6335->6336 6337 4076f9 6336->6337 6338 40a93c 3 API calls 6337->6338 6339 407700 6337->6339 6338->6339 6339->6293 6341 40a687 HeapAlloc 6340->6341 6342 406b56 _memset 6341->6342 6342->6298 6344 404b80 6343->6344 6345 404b71 RaiseException 6343->6345 6344->6345 6346 404b8e GetCurrentThreadId EnterCriticalSection 6344->6346 6345->6344 6347 40145c LeaveCriticalSection 6346->6347 6348 404bbb 6347->6348 6349 4081eb 6348->6349 6350 40194e 14 API calls 6349->6350 6351 4081f6 FindResourceW 6350->6351 6352 4082bb 6351->6352 6353 40821b FindResourceW 6351->6353 6352->6269 6352->6313 6354 408241 LoadResource 6353->6354 6355 408238 LoadResource LockResource 6353->6355 6356 408251 LockResource 6354->6356 6357 40829f GetLastError 6354->6357 6355->6354 6356->6357 6358 40825a 6356->6358 6359 4082a9 6357->6359 6366 40666c 6358->6366 6359->6352 6360 4082b1 SetLastError 6359->6360 6360->6352 6363 408281 GetLastError 6364 40828b 6363->6364 6364->6359 6365 40828f GlobalHandle GlobalFree 6364->6365 6365->6359 6368 40667e 6366->6368 6367 4066f6 CreateDialogIndirectParamW 6367->6363 6367->6364 6368->6367 6369 4066fd GlobalAlloc 6368->6369 6370 401082 __VEC_memcpy 6369->6370 6372 406715 6370->6372 6371 401029 RaiseException 6371->6372 6372->6371 6373 406798 6372->6373 6374 401082 __VEC_memcpy 6372->6374 6373->6367 6374->6372 6378 406a5a moneypunct 6375->6378 6376 4077a0 6376->6307 6379 40a212 6376->6379 6377 40a66d __freea HeapFree 6377->6376 6378->6376 6378->6377 6382 40a137 6379->6382 6381 40a21b 6381->6307 6383 40a155 RtlInterlockedPushEntrySList 6382->6383 6384 40a145 GetProcessHeap HeapFree 6382->6384 6383->6381 6384->6381 6386 401495 6385->6386 6388 40148e 6385->6388 6387 4010ed SendMessageW 6386->6387 6387->6388 6388->6318 6388->6322 6390 408188 6389->6390 6391 40818d LeaveCriticalSection 6390->6391 6393 4067cf 6390->6393 6391->6333 6394 40685b 6393->6394 6397 4067df 6393->6397 6394->6391 6395 40a93c 3 API calls 6396 40683d 6395->6396 6398 40a93c 3 API calls 6396->6398 6397->6394 6397->6395 6398->6394 6400 40814b 6399->6400 6401 40813c 6399->6401 6403 408160 LeaveCriticalSection 6400->6403 6404 40a2e7 HeapFree 6400->6404 6401->6400 6402 408141 DestroyWindow 6401->6402 6402->6400 6405 40145c LeaveCriticalSection 6403->6405 6406 408159 moneypunct 6404->6406 6407 408177 6405->6407 6406->6403 6407->6290 6408 40687a 6407->6408 6409 406883 6408->6409 6411 406889 6408->6411 6410 40a66d __freea HeapFree 6409->6410 6410->6411 6412 40689a 6411->6412 6413 40a66d __freea HeapFree 6411->6413 6412->6290 6413->6412 6414->6249 6415->6254 6978 405cde 6981 404fe4 6978->6981 6980 405d08 6982 404ff1 6981->6982 6983 404ffe 6982->6983 6985 404074 6982->6985 6983->6980 6986 4040a6 EnterCriticalSection 6985->6986 6987 40409a 6985->6987 6988 4040cd 6986->6988 6998 4041c7 6986->6998 6987->6986 6994 40409f 6987->6994 6991 40413e LoadRegTypeLib 6988->6991 6995 4040f4 GetModuleFileNameW 6988->6995 6989 40ab6a __invoke_watson 5 API calls 6990 40422e 6989->6990 6990->6983 7001 40413c 6991->7001 6992 40145c LeaveCriticalSection 6992->6994 6993 402a2e 4 API calls 6996 404211 6993->6996 6994->6989 6997 404112 6995->6997 6995->6998 6996->6992 6997->6998 6999 404120 LoadTypeLib 6997->6999 6998->6993 6998->6996 7000 401125 HeapFree 6999->7000 7000->7001 7001->6998 7002 404058 3 API calls 7001->7002 7002->6998 6515 40965f 6516 409699 6515->6516 6552 401ce1 6516->6552 6518 4096af 6556 40751f 6518->6556 6519 4096ea 6519->6518 6526 4096ff GetModuleFileNameW 6519->6526 6520 4096a1 6520->6518 6520->6519 6563 4078c4 6520->6563 6527 409721 6526->6527 6528 409735 6526->6528 6531 401d2c GetLastError 6527->6531 6529 409739 6528->6529 6530 40974b 6528->6530 6532 401125 HeapFree 6529->6532 6534 409767 GetModuleHandleW 6530->6534 6535 409778 6530->6535 6533 409726 6531->6533 6532->6518 6536 401125 HeapFree 6533->6536 6534->6535 6537 409773 6534->6537 6571 401ca1 lstrlenW 6535->6571 6536->6518 6540 4078c4 9 API calls 6537->6540 6543 4097e6 6540->6543 6541 40979d 6544 401125 HeapFree 6541->6544 6542 4097af lstrlenW 6542->6537 6543->6533 6545 4078c4 9 API calls 6543->6545 6544->6518 6546 409802 6545->6546 6546->6533 6547 40980c 6546->6547 6548 40982d 6547->6548 6574 409591 6547->6574 6583 409613 6548->6583 6551 409837 6551->6551 6592 40abac 6552->6592 6554 401ced InitializeCriticalSection 6555 401d1c __get_sse2_info 6554->6555 6555->6520 6593 40742c EnterCriticalSection 6556->6593 6558 40752e 6559 407542 6558->6559 6560 407537 DeleteCriticalSection 6558->6560 6596 4073af 6559->6596 6560->6559 6564 4078cd 6563->6564 6565 40790b 6563->6565 6564->6565 6566 4078d3 EnterCriticalSection 6564->6566 6565->6520 6567 4078e8 6566->6567 6607 4077e0 6567->6607 6569 4078fa LeaveCriticalSection 6570 401125 HeapFree 6569->6570 6570->6565 6572 40a6a0 __VEC_memcpy 6571->6572 6573 401cc4 6572->6573 6573->6541 6573->6542 6575 40959b 6574->6575 6576 4095cd 6575->6576 6577 4095aa 6575->6577 6578 401125 HeapFree 6576->6578 6620 40940c 6577->6620 6579 4095c8 6578->6579 6579->6548 6582 401125 HeapFree 6582->6579 6584 40961d 6583->6584 6585 40964e 6584->6585 6586 40962c 6584->6586 6587 401125 HeapFree 6585->6587 6588 40940c 66 API calls 6586->6588 6591 409649 6587->6591 6589 40963f 6588->6589 6590 401125 HeapFree 6589->6590 6590->6591 6591->6551 6592->6554 6594 4073af ctype 3 API calls 6593->6594 6595 407444 LeaveCriticalSection 6594->6595 6595->6558 6597 4073e0 6596->6597 6602 4073ba moneypunct 6596->6602 6598 40687a ctype HeapFree 6597->6598 6600 4073e7 6598->6600 6601 407244 ctype RaiseException 6601->6602 6602->6597 6602->6601 6603 40721d 6602->6603 6604 407232 RaiseException 6603->6604 6605 407225 6603->6605 6605->6604 6606 40722a 6605->6606 6606->6602 6608 4077f4 6607->6608 6609 40788a moneypunct 6607->6609 6608->6609 6610 4077fd lstrlenW 6608->6610 6609->6569 6611 40a687 HeapAlloc 6610->6611 6612 407828 lstrlenW 6611->6612 6613 40a687 HeapAlloc 6612->6613 6614 407850 6613->6614 6614->6609 6615 401082 __VEC_memcpy 6614->6615 6616 40786a 6615->6616 6617 401082 __VEC_memcpy 6616->6617 6618 407877 6617->6618 6619 4076e8 3 API calls 6618->6619 6619->6609 6621 40944a LoadLibraryExW 6620->6621 6622 409477 FindResourceW 6621->6622 6623 40946b 6621->6623 6625 409494 LoadResource 6622->6625 6626 40948a 6622->6626 6624 401d2c GetLastError 6623->6624 6628 409470 6624->6628 6625->6626 6627 4094a3 SizeofResource 6625->6627 6629 401d2c GetLastError 6626->6629 6631 4094b4 6627->6631 6632 4094ed 6627->6632 6637 40729f HeapFree 6628->6637 6640 4094c4 6628->6640 6630 40948f FreeLibrary 6629->6630 6630->6628 6631->6640 6646 40729f 6631->6646 6649 40773b 6632->6649 6636 401125 HeapFree 6639 4094d1 6636->6639 6637->6640 6641 40ab6a __invoke_watson 5 API calls 6639->6641 6640->6636 6643 4094e3 6641->6643 6642 40950a MultiByteToWideChar 6642->6626 6644 409520 6642->6644 6643->6582 6654 409138 6644->6654 6647 40a66d __freea HeapFree 6646->6647 6648 4072a6 6647->6648 6648->6640 6669 4072c9 6649->6669 6655 40914a 6654->6655 6683 40759b 6655->6683 6657 409211 6658 40ab6a __invoke_watson 5 API calls 6657->6658 6659 409221 6658->6659 6659->6630 6660 409250 6661 409206 CoTaskMemFree 6660->6661 6661->6657 6663 407054 7 API calls 6665 409173 6663->6665 6664 407bbf 43 API calls 6664->6665 6665->6657 6665->6660 6665->6661 6665->6663 6665->6664 6666 4091f1 6665->6666 6702 406fb9 6665->6702 6741 407032 6665->6741 6707 407bbf 6666->6707 6670 4072dc 6669->6670 6671 4072e9 6670->6671 6672 401029 RaiseException 6670->6672 6673 4074b7 6671->6673 6672->6671 6674 4074c4 6673->6674 6675 4074cd 6673->6675 6677 4072a8 6674->6677 6675->6630 6675->6642 6682 40a609 HeapAlloc 6677->6682 6679 4072b4 6680 4072c3 6679->6680 6681 401029 RaiseException 6679->6681 6680->6675 6681->6680 6682->6679 6684 4075c1 6683->6684 6685 4076d2 6683->6685 6684->6685 6686 4075c9 lstrlenW 6684->6686 6688 40ab6a __invoke_watson 5 API calls 6685->6688 6745 406e3a 6686->6745 6690 4076e4 6688->6690 6690->6665 6691 4075e5 CoTaskMemFree 6691->6685 6692 40769c CoTaskMemFree 6692->6685 6694 407612 CharNextW 6701 4075f6 6694->6701 6697 40768c CharNextW 6697->6692 6697->6701 6700 407671 CharNextW 6700->6700 6700->6701 6701->6692 6701->6694 6701->6697 6701->6700 6749 406fe4 6701->6749 6754 407570 EnterCriticalSection 6701->6754 6757 4073ec 6701->6757 6764 406e6c 6701->6764 6703 406fbc lstrcmpiW 6702->6703 6704 406fd1 6703->6704 6705 406fdb 6703->6705 6704->6703 6706 406fd7 6704->6706 6705->6665 6706->6665 6740 407c29 6707->6740 6708 407f32 6709 406cd1 RegCloseKey 6708->6709 6731 40804d 6709->6731 6710 407c01 lstrcmpiW lstrcmpiW 6710->6740 6711 407cc2 lstrcmpiW 6713 407ce8 lstrcmpiW 6711->6713 6711->6740 6712 40ab6a __invoke_watson 5 API calls 6714 40808c 6712->6714 6713->6740 6714->6661 6715 406fe4 CharNextW 6715->6740 6716 408025 6718 406cd1 RegCloseKey 6716->6718 6717 407157 lstrcmpiW 6717->6740 6718->6708 6719 4072ee 9 API calls 6719->6740 6721 407054 7 API calls 6721->6740 6723 406d36 RegCloseKey RegOpenKeyExW 6723->6740 6724 407928 27 API calls 6724->6740 6725 407fe4 lstrlenW 6725->6740 6726 406cd1 RegCloseKey 6726->6708 6727 408045 6729 406cd1 RegCloseKey 6727->6729 6728 407d8d RegDeleteValueW 6728->6740 6729->6731 6730 407bbf 35 API calls 6730->6740 6731->6712 6732 4071b8 12 API calls 6732->6740 6733 407ece lstrlenW 6733->6740 6734 407183 RegQueryInfoKeyW 6734->6740 6735 406cd1 RegCloseKey 6735->6740 6736 408056 6737 406cd1 RegCloseKey 6736->6737 6737->6731 6738 407fb2 RegDeleteKeyW 6739 408034 6738->6739 6738->6740 6739->6726 6740->6708 6740->6710 6740->6711 6740->6713 6740->6715 6740->6716 6740->6717 6740->6719 6740->6721 6740->6723 6740->6724 6740->6725 6740->6727 6740->6728 6740->6730 6740->6732 6740->6733 6740->6734 6740->6735 6740->6736 6740->6738 6740->6739 6788 406cd1 6740->6788 6791 406ce8 RegCreateKeyExW 6740->6791 6742 407043 6741->6742 6743 407052 6742->6743 6744 407037 CharNextW 6742->6744 6743->6665 6744->6742 6746 406e46 6745->6746 6770 406b8f 6746->6770 6748 406e59 6748->6691 6748->6701 6750 406fef 6749->6750 6751 406ff1 6749->6751 6750->6701 6752 407007 6751->6752 6753 406ff8 CharNextW 6751->6753 6752->6701 6753->6751 6774 40746b 6754->6774 6758 4073fd lstrlenW 6757->6758 6763 4073f9 6757->6763 6760 406e6c 2 API calls 6758->6760 6761 40741b 6760->6761 6762 401125 HeapFree 6761->6762 6762->6763 6763->6701 6765 406e7e 6764->6765 6769 406edc 6764->6769 6766 406ea6 6765->6766 6765->6769 6784 406bbc 6765->6784 6768 401082 __VEC_memcpy 6766->6768 6766->6769 6768->6769 6769->6701 6771 406ba6 6770->6771 6772 406bb1 CoTaskMemAlloc 6771->6772 6773 406bad 6771->6773 6772->6748 6773->6748 6779 40726c 6774->6779 6777 40747c LeaveCriticalSection 6777->6701 6778 407244 ctype RaiseException 6778->6777 6780 407293 6779->6780 6781 407277 6779->6781 6780->6777 6780->6778 6781->6780 6783 406e09 lstrcmpiW 6781->6783 6783->6781 6785 406bd3 6784->6785 6786 406bda 6785->6786 6787 406bde CoTaskMemRealloc 6785->6787 6786->6766 6787->6766 6789 406ce6 6788->6789 6790 406cdc RegCloseKey 6788->6790 6789->6711 6790->6789 6792 406d1c 6791->6792 6793 406d2c 6792->6793 6794 406cd1 RegCloseKey 6792->6794 6793->6740 6794->6793 6795 403060 OleLockRunning 6796 40308b 6795->6796 7003 4026e0 7004 4026eb 7003->7004 7005 4026fe GetWindowLongW 7003->7005 7012 4025ce CallWindowProcW 7004->7012 7013 4025ce CallWindowProcW 7005->7013 7008 40271d 7009 40272b GetWindowLongW 7008->7009 7011 4026f9 7008->7011 7010 402738 SetWindowLongW 7009->7010 7009->7011 7010->7011 7012->7011 7013->7008 7138 404961 7140 40496d 7138->7140 7139 402933 RaiseException 7139->7140 7140->7139 7141 404978 7140->7141 7142 40d762 7147 40a3fb 7142->7147 7144 40d76c 7155 40a966 7144->7155 7146 40d776 7148 40a418 _memset 7147->7148 7149 40a43d GetVersionExA 7148->7149 7152 40a457 7149->7152 7150 401ce1 InitializeCriticalSection 7151 40a48d 7150->7151 7153 40ab6a __invoke_watson 5 API calls 7151->7153 7152->7150 7154 40a4a5 7153->7154 7154->7144 7169 40abac 7155->7169 7157 40a972 EnterCriticalSection 7158 40a995 7157->7158 7159 40a98c 7157->7159 7164 40a9a0 LeaveCriticalSection 7158->7164 7170 40a65a HeapSize 7158->7170 7161 40a61c HeapAlloc 7159->7161 7161->7158 7162 40a9be 7163 40a9e4 LeaveCriticalSection 7162->7163 7165 40a93c 3 API calls 7162->7165 7167 40aa1e __get_sse2_info 7163->7167 7164->7167 7168 40a9dd 7165->7168 7167->7146 7168->7163 7168->7164 7169->7157 7170->7162 5623 408765 5624 408776 5623->5624 5625 40879f 5623->5625 5632 409d44 5624->5632 5635 409d65 FindResourceW 5624->5635 5662 4084de 5625->5662 5627 408782 5627->5625 5629 408788 DestroyWindow SetLastError 5627->5629 5628 4087ae 5629->5628 5668 409c9e 5632->5668 5636 409db2 FindResourceW 5635->5636 5637 409d9b LoadResource 5635->5637 5639 409dc5 LoadResource 5636->5639 5643 40a030 5636->5643 5637->5636 5638 409da8 LockResource 5637->5638 5638->5636 5640 409dd6 LockResource 5639->5640 5641 40a058 5639->5641 5640->5641 5644 409de7 5640->5644 5642 401d2c GetLastError 5641->5642 5642->5643 5643->5627 5645 409e07 GetWindow 5644->5645 5645->5643 5646 409e29 5645->5646 5646->5643 5647 40a004 GetWindow 5646->5647 5648 409e69 GlobalAlloc 5646->5648 5653 409fe5 SysFreeString 5646->5653 5654 40194e 14 API calls 5646->5654 5655 409f27 MapDialogRect 5646->5655 5658 409f9a SetWindowContextHelpId 5646->5658 5659 409d44 93 API calls 5646->5659 5660 40a040 SysFreeString 5646->5660 5661 409fc8 SetWindowPos 5646->5661 5905 401235 5646->5905 5916 40868e 5646->5916 5919 401d2c GetLastError 5646->5919 5647->5646 5648->5643 5649 409e7c GlobalLock 5648->5649 5651 401082 __VEC_memcpy 5649->5651 5652 409e8e GlobalUnlock CreateStreamOnHGlobal 5651->5652 5652->5646 5653->5646 5654->5646 5655->5646 5658->5646 5659->5646 5660->5643 5661->5653 5663 408501 5662->5663 5935 409bd5 5663->5935 5665 408560 SetWindowLongW 5666 408558 5665->5666 5666->5628 5676 4088c8 5668->5676 5671 409cc5 5720 406144 5671->5720 5672 409cdc 5681 4054a5 5672->5681 5674 409cd8 5674->5627 5677 4088d3 5676->5677 5678 4088da 5676->5678 5677->5671 5677->5672 5729 4084a6 5678->5729 5682 4054b3 5681->5682 5683 4054bd 5681->5683 5682->5674 5732 403691 5683->5732 5686 405504 IsWindow 5686->5682 5688 405515 5686->5688 5687 4054ec RedrawWindow 5762 40319c 5687->5762 5690 405525 5688->5690 5767 40317c 5688->5767 5692 40554f 5690->5692 5770 401f0e GetParent GetClassNameW 5690->5770 5736 40348a 5692->5736 5699 403691 ctype DestroyAcceleratorTable 5700 40575d 5699->5700 5700->5682 5702 405766 RedrawWindow 5700->5702 5701 40557d 5703 4055c5 GetWindowLongW 5701->5703 5718 40573b 5701->5718 5702->5682 5704 405779 5702->5704 5705 4055e7 GetWindowLongW SetWindowLongW SetWindowPos 5703->5705 5710 4055db 5703->5710 5704->5682 5706 40577f 5704->5706 5705->5710 5707 40319c 3 API calls 5706->5707 5707->5682 5708 40579a 5709 4057b3 VariantInit 5708->5709 5708->5718 5778 4029ef VariantClear SysAllocString 5709->5778 5710->5708 5713 4056a1 lstrlenW GlobalAlloc 5710->5713 5714 4056bf GlobalLock 5713->5714 5719 4056f4 5713->5719 5775 401082 5714->5775 5716 4056d6 GlobalUnlock CreateStreamOnHGlobal 5716->5719 5718->5682 5718->5699 5719->5718 5852 40194e EnterCriticalSection RegisterWindowMessageW RegisterWindowMessageW GetClassInfoExW 5720->5852 5725 4061be 5725->5674 5730 4084b6 SendMessageW 5729->5730 5731 4084af 5729->5731 5730->5731 5731->5677 5733 4037c7 5732->5733 5734 4036a6 ctype 5732->5734 5733->5686 5733->5687 5734->5733 5735 4037be DestroyAcceleratorTable 5734->5735 5735->5733 5737 4034b4 5736->5737 5752 4034aa 5736->5752 5743 403538 CoCreateInstance 5737->5743 5737->5752 5782 401dc4 5737->5782 5738 40ab6a __invoke_watson 5 API calls 5739 40361c 5738->5739 5739->5701 5753 4044a7 5739->5753 5742 403571 lstrlenW 5745 403583 5742->5745 5742->5752 5743->5752 5746 403596 CLSIDFromProgID 5745->5746 5747 40358e CLSIDFromString 5745->5747 5748 40359c 5746->5748 5747->5748 5749 4035a5 SysStringLen 5748->5749 5748->5752 5750 4035b2 CoGetClassObject 5749->5750 5751 4035f6 CoCreateInstance 5749->5751 5750->5752 5751->5752 5752->5738 5754 4044b8 5753->5754 5755 4044bf 5753->5755 5754->5701 5755->5754 5756 4046c9 GetClientRect 5755->5756 5788 40253c 5756->5788 5758 404708 5794 4024bf 5758->5794 5760 40473d 5761 404782 RedrawWindow 5760->5761 5761->5754 5763 4031b8 DestroyWindow 5762->5763 5764 4031a8 5762->5764 5766 4031af 5763->5766 5802 4027bf GetWindowLongW 5764->5802 5766->5686 5806 402781 5767->5806 5771 401f39 lstrcmpW 5770->5771 5772 401f4d 5770->5772 5771->5772 5773 40ab6a __invoke_watson 5 API calls 5772->5773 5774 401f57 GetSysColor 5773->5774 5774->5692 5844 40a6a0 5775->5844 5777 401097 5777->5716 5779 402a28 VariantClear VariantClear 5778->5779 5780 402a0f 5778->5780 5779->5718 5780->5779 5781 401029 RaiseException 5780->5781 5781->5779 5783 401dfd 5782->5783 5785 401dce 5782->5785 5783->5742 5783->5743 5784 401df4 CharNextW 5784->5783 5784->5785 5785->5783 5785->5784 5786 401e02 CharNextW 5785->5786 5787 401ded CharNextW 5785->5787 5786->5783 5787->5785 5789 402545 5788->5789 5790 40254f 5788->5790 5800 401029 RaiseException 5789->5800 5792 402562 6 API calls 5790->5792 5793 401029 RaiseException 5790->5793 5792->5758 5793->5792 5795 4024d2 5794->5795 5796 4024c8 5794->5796 5798 4024e5 6 API calls 5795->5798 5799 401029 RaiseException 5795->5799 5797 401029 RaiseException 5796->5797 5797->5795 5798->5760 5799->5798 5801 40104d 5800->5801 5801->5790 5803 4027e0 SetWindowLongW 5802->5803 5804 4027dc 5802->5804 5805 4027f4 5803->5805 5804->5803 5804->5805 5805->5766 5807 40278a 5806->5807 5812 401e3a 5807->5812 5810 40279a 5810->5690 5811 40279e SetWindowLongW 5811->5810 5813 401e42 5812->5813 5814 401e47 5812->5814 5818 40a2bf 5813->5818 5817 401e5c 5814->5817 5834 401e07 GetCurrentProcess FlushInstructionCache 5814->5834 5817->5810 5817->5811 5819 40a21f 5818->5819 5820 40a232 5819->5820 5821 40a229 5819->5821 5823 40a253 RtlInterlockedPopEntrySList 5820->5823 5824 40a23c GetProcessHeap HeapAlloc 5820->5824 5835 40a15d IsProcessorFeaturePresent 5821->5835 5828 40a25e VirtualAlloc 5823->5828 5832 40a2ba 5823->5832 5826 40a251 5824->5826 5827 40a275 5824->5827 5825 40a22e 5825->5820 5825->5827 5826->5814 5827->5814 5828->5827 5829 40a279 RtlInterlockedPopEntrySList 5828->5829 5830 40a2a0 5829->5830 5831 40a28e VirtualFree 5829->5831 5833 40a2a6 RtlInterlockedPushEntrySList 5830->5833 5831->5832 5832->5814 5833->5832 5833->5833 5834->5817 5836 40a172 LoadLibraryA 5835->5836 5837 40a16a 5835->5837 5838 40a188 GetProcAddress GetProcAddress 5836->5838 5839 40a1a8 5836->5839 5837->5825 5838->5839 5840 40a1ca GetProcessHeap HeapAlloc 5839->5840 5843 40a1ff 5839->5843 5841 40a1e2 InterlockedCompareExchange 5840->5841 5840->5843 5842 40a1f4 GetProcessHeap HeapFree 5841->5842 5841->5843 5842->5843 5843->5825 5845 40a6b1 5844->5845 5846 40a6ab _memset 5844->5846 5845->5777 5846->5845 5848 40c5f0 5846->5848 5849 40c608 5848->5849 5850 40c637 5849->5850 5851 40c62f __VEC_memcpy 5849->5851 5850->5845 5851->5850 5853 401a12 _memset 5852->5853 5854 4019aa LoadCursorW RegisterClassExW 5852->5854 5857 401a1d GetClassInfoExW 5853->5857 5855 401a04 5854->5855 5863 401aa4 5854->5863 5876 4017b2 5855->5876 5858 401a40 LoadCursorW RegisterClassExW 5857->5858 5857->5863 5861 401a96 5858->5861 5858->5863 5859 40145c LeaveCriticalSection 5860 401ab8 5859->5860 5864 40604d 5860->5864 5862 4017b2 4 API calls 5861->5862 5862->5863 5863->5859 5865 406060 5864->5865 5866 406059 5864->5866 5867 40a687 HeapAlloc 5865->5867 5866->5725 5870 401207 5866->5870 5868 406072 5867->5868 5868->5866 5897 405e80 5868->5897 5871 401211 SysFreeString 5870->5871 5872 40121a SysAllocString 5870->5872 5871->5725 5872->5871 5873 40122a 5872->5873 5874 401029 RaiseException 5873->5874 5875 401234 5874->5875 5877 4017c5 5876->5877 5879 4017fd 5876->5879 5878 4017dc 5877->5878 5880 401029 RaiseException 5877->5880 5878->5879 5882 40a93c 5878->5882 5879->5853 5880->5878 5883 40a944 5882->5883 5884 40a951 5883->5884 5887 40a900 5883->5887 5884->5879 5886 40a963 5886->5879 5888 40a915 5887->5888 5889 40a90a 5887->5889 5891 40a927 HeapReAlloc 5888->5891 5892 40a91a 5888->5892 5896 40a609 HeapAlloc 5889->5896 5891->5886 5894 40a66d __freea HeapFree 5892->5894 5893 40a912 5893->5886 5895 40a922 5894->5895 5895->5886 5896->5893 5898 405e95 5897->5898 5901 401c13 5898->5901 5904 401b4a GetSysColor 5901->5904 5903 401c1b 5903->5866 5904->5903 5908 40126e 5905->5908 5913 401267 5905->5913 5906 40ab6a __invoke_watson 5 API calls 5907 401393 5906->5907 5907->5646 5908->5913 5921 4011d7 5908->5921 5910 4012c8 SysStringLen 5911 4012d6 SysFreeString 5910->5911 5914 4012e9 _memset 5910->5914 5911->5913 5913->5906 5914->5911 5915 401315 SysFreeString 5914->5915 5915->5913 5932 408457 5916->5932 5918 4086b0 5918->5646 5920 401d36 5919->5920 5920->5646 5922 4011e1 5921->5922 5923 4011ea SysAllocStringLen 5921->5923 5922->5910 5923->5922 5924 4011fc 5923->5924 5925 401029 RaiseException 5924->5925 5926 401206 5925->5926 5927 401211 5926->5927 5928 40121a SysAllocString 5926->5928 5927->5910 5928->5927 5929 40122a 5928->5929 5930 401029 RaiseException 5929->5930 5931 401234 5930->5931 5933 408465 5932->5933 5934 40846a CreateWindowExW 5932->5934 5933->5934 5934->5918 5936 408520 5935->5936 5937 409bec 5935->5937 5936->5665 5936->5666 5950 409b6c 5937->5950 5940 409c16 5957 405b93 GetCurrentThreadId 5940->5957 5941 409c3b 5943 409c43 5941->5943 5944 409c59 5941->5944 5966 405bf6 GetCurrentThreadId 5943->5966 5944->5936 5946 409c80 5944->5946 5947 409c67 5944->5947 5946->5936 5949 401473 2 API calls 5946->5949 5970 401473 5947->5970 5949->5936 5951 409b96 5950->5951 5952 409b75 5950->5952 5951->5936 5951->5940 5951->5941 5953 409ba6 5952->5953 5954 409b7f 5952->5954 5953->5951 5978 409040 5953->5978 5973 4093e7 5954->5973 6044 401b05 EnterCriticalSection 5957->6044 5961 405bc8 5962 401845 4 API calls 5961->5962 5963 405be2 5962->5963 6055 401ac0 5963->6055 5967 401b05 4 API calls 5966->5967 5968 405c0f 5967->5968 5969 405c45 KillTimer 5968->5969 5969->5936 6073 401191 KiUserCallbackDispatcher PostQuitMessage 5970->6073 5985 408ec0 FindResourceW 5973->5985 5976 409040 9 API calls 5977 4093fc 5976->5977 5977->5951 5982 40904b 5978->5982 5979 409128 5979->5951 5980 40907b GetDlgItem 5980->5979 5980->5982 5982->5979 5982->5980 6029 4010ed 5982->6029 6032 408b40 5982->6032 6040 408915 5982->6040 5986 408f05 LoadResource 5985->5986 5987 409026 5985->5987 5986->5987 5989 408f15 LockResource 5986->5989 5988 40ab6a __invoke_watson 5 API calls 5987->5988 5990 409039 5988->5990 5989->5987 5994 408f26 5989->5994 5990->5976 5993 4088a8 10 API calls 5993->5994 5994->5987 5994->5993 5995 408fea SendDlgItemMessageW 5994->5995 5996 40a66d HeapFree __freea 5994->5996 5997 4088a8 5994->5997 5995->5994 5996->5994 5998 4088b6 5997->5998 6001 4086b4 5998->6001 6002 4086cb lstrlenA 6001->6002 6006 4086c4 SendDlgItemMessageW 6001->6006 6012 4085a5 6002->6012 6005 40870a GetLastError 6007 408755 6005->6007 6008 408715 MultiByteToWideChar 6005->6008 6006->5994 6007->6006 6019 4083e3 GetLastError 6007->6019 6009 4085a5 4 API calls 6008->6009 6010 40873a MultiByteToWideChar 6009->6010 6010->6007 6014 4085b1 6012->6014 6013 401029 RaiseException 6013->6014 6014->6013 6016 40a93c 3 API calls 6014->6016 6017 40a66d __freea HeapFree 6014->6017 6018 4085fb MultiByteToWideChar 6014->6018 6023 40a61c 6014->6023 6016->6014 6017->6014 6018->6005 6018->6006 6020 4083ed 6019->6020 6021 401029 RaiseException 6020->6021 6022 4083fd 6021->6022 6024 40a625 6023->6024 6025 40a632 6024->6025 6028 40a609 HeapAlloc 6024->6028 6025->6014 6027 40a642 _memset 6027->6014 6028->6027 6030 4010f6 6029->6030 6031 4010fd SendMessageW 6029->6031 6030->5982 6031->6030 6035 408b75 6032->6035 6039 408c71 6032->6039 6033 40ab6a __invoke_watson 5 API calls 6034 408dfc 6033->6034 6034->5982 6036 401082 __VEC_memcpy 6035->6036 6035->6039 6037 408c31 6036->6037 6038 401082 __VEC_memcpy 6037->6038 6037->6039 6038->6039 6039->6033 6041 408920 6040->6041 6042 40892a 6040->6042 6043 401029 RaiseException 6041->6043 6042->5982 6043->6042 6059 401ae2 6044->6059 6047 40145c LeaveCriticalSection 6048 401b42 6047->6048 6049 401845 6048->6049 6050 401858 6049->6050 6052 401890 6049->6052 6051 40186f 6050->6051 6053 401029 RaiseException 6050->6053 6051->6052 6054 40a93c 3 API calls 6051->6054 6052->5961 6053->6051 6054->6052 6056 401acc 6055->6056 6057 401ade 6055->6057 6067 4018b7 6056->6067 6057->5936 6060 401aee 6059->6060 6061 401af3 LeaveCriticalSection 6060->6061 6063 407244 6060->6063 6061->6047 6064 40725a RaiseException 6063->6064 6065 40724c 6063->6065 6065->6064 6066 407251 6065->6066 6066->6061 6068 4018ca 6067->6068 6069 401902 6067->6069 6070 4018e1 6068->6070 6071 401029 RaiseException 6068->6071 6069->6057 6070->6069 6072 40a93c 3 API calls 6070->6072 6071->6070 6072->6069 7171 402b65 7172 402b8d 7171->7172 7173 402b6e 7171->7173 7173->7172 7175 40139b 7173->7175 7176 4013cc SysFreeString 7175->7176 7177 4013a8 moneypunct 7175->7177 7176->7177 7177->7172 7253 40cfe8 7254 40cffa 7253->7254 7255 40d008 @_EH4_CallFilterFunc@8 7253->7255 7256 40ab6a __invoke_watson 5 API calls 7254->7256 7256->7255 6797 40a06a GetThreadLocale GetLocaleInfoA 6798 40a0b8 GetACP 6797->6798 6800 40a099 6797->6800 6799 40a0c0 6798->6799 6801 40ab6a __invoke_watson 5 API calls 6799->6801 6800->6798 6800->6799 6802 40a0cd 6801->6802 7257 40d1eb 7264 40aaf0 7257->7264 7259 40d27c IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 7260 40d2b3 __invoke_watson 7259->7260 7261 40d2bf GetCurrentProcess TerminateProcess 7259->7261 7260->7261 7262 40ab6a __invoke_watson 5 API calls 7261->7262 7263 40d2df 7262->7263 7265 40aafc __VEC_memzero 7264->7265 7265->7259 6803 404c6c 6806 404c3d 6803->6806 6809 404dd5 6806->6809 6810 404ddf 6809->6810 6811 404df0 DestroyWindow 6810->6811 6812 404c59 6810->6812 6811->6812 6813 404e70 6816 404df9 6813->6816 6817 404dd5 ctype DestroyWindow 6816->6817 6818 404e15 6817->6818 7266 4053f3 7267 403691 ctype DestroyAcceleratorTable 7266->7267 7268 40540e 7267->7268 7269 40543a IsWindow 7268->7269 7270 40542b RedrawWindow 7268->7270 7271 405448 7269->7271 7272 405499 7269->7272 7273 40319c 3 API calls 7270->7273 7274 40317c 19 API calls 7271->7274 7277 405459 7271->7277 7273->7269 7274->7277 7275 4044a7 15 API calls 7276 40546d 7275->7276 7276->7272 7278 403691 ctype DestroyAcceleratorTable 7276->7278 7277->7275 7279 40547c 7278->7279 7279->7272 7280 405483 RedrawWindow 7279->7280 7280->7272 7281 405492 7280->7281 7282 40319c 3 API calls 7281->7282 7282->7272 5563 404074 5564 4040a6 EnterCriticalSection 5563->5564 5565 40409a 5563->5565 5566 4040cd 5564->5566 5576 4041c7 5564->5576 5565->5564 5572 40409f 5565->5572 5569 40413e LoadRegTypeLib 5566->5569 5573 4040f4 GetModuleFileNameW 5566->5573 5568 40422e 5579 40413c 5569->5579 5599 40ab6a 5572->5599 5575 404112 5573->5575 5573->5576 5574 404211 5596 40145c 5574->5596 5575->5576 5577 404120 LoadTypeLib 5575->5577 5576->5574 5588 402a2e 5576->5588 5581 401125 5577->5581 5579->5576 5585 404058 5579->5585 5584 40112a 5581->5584 5582 40113c 5582->5579 5584->5582 5607 40a66d 5584->5607 5610 403427 5585->5610 5589 402a46 5588->5589 5590 402ab5 5589->5590 5591 40a687 HeapAlloc 5589->5591 5592 402a86 5589->5592 5590->5574 5591->5592 5592->5590 5595 402b33 SysFreeString 5592->5595 5619 401da8 5592->5619 5595->5592 5597 401471 5596->5597 5598 401465 LeaveCriticalSection 5596->5598 5597->5572 5598->5597 5600 40ab72 5599->5600 5601 40ab74 IsDebuggerPresent 5599->5601 5600->5568 5622 40d5cc 5601->5622 5604 40cf1e SetUnhandledExceptionFilter UnhandledExceptionFilter 5605 40cf43 GetCurrentProcess TerminateProcess 5604->5605 5606 40cf3b __invoke_watson 5604->5606 5605->5568 5606->5605 5608 40a674 HeapFree 5607->5608 5609 40a686 5607->5609 5608->5609 5609->5584 5611 403434 5610->5611 5612 40343b 5610->5612 5611->5576 5617 40a687 5612->5617 5614 403444 5614->5611 5615 403452 EnterCriticalSection 5614->5615 5616 40145c LeaveCriticalSection 5615->5616 5616->5611 5618 40a609 HeapAlloc 5617->5618 5618->5614 5620 401db6 SysFreeString 5619->5620 5621 401dbf SysStringLen 5619->5621 5620->5621 5621->5592 5622->5604 7014 4022f5 7015 40230d 7014->7015 7016 402303 7014->7016 7015->7016 7017 402317 GetDC 7015->7017 7017->7016 7018 402330 7017->7018 7018->7016 7019 40233e GetClientRect 7018->7019 7020 402351 CreateCompatibleDC 7019->7020 7021 4023a9 7019->7021 7020->7021 7022 402360 CreateCompatibleBitmap 7020->7022 7021->7016 7023 4023b0 FillRect 7021->7023 7024 402392 DeleteDC 7022->7024 7025 40237d SelectObject 7022->7025 7023->7016 7024->7021 7026 402389 DeleteObject 7025->7026 7027 40239b DeleteObject 7025->7027 7026->7024 7027->7021 7028 4060f6 7029 406110 7028->7029 7030 406109 7028->7030 7029->7030 7032 405fee 7029->7032 7033 405fff 7032->7033 7034 405f6f 13 API calls 7033->7034 7035 406013 7034->7035 7036 404d11 24 API calls 7035->7036 7037 406047 7036->7037 7037->7030 7178 40d778 7183 40a3d5 7178->7183 7181 40a966 7 API calls 7182 40d78c 7181->7182 7184 40a3dd 7183->7184 7187 40a2c4 7184->7187 7188 40a2d3 7187->7188 7189 40a2cc 7187->7189 7188->7189 7190 401ce1 InitializeCriticalSection 7188->7190 7189->7181 7190->7189 7038 4074fd 7041 4068e7 7038->7041 7040 40750b moneypunct 7042 4068f3 7041->7042 7043 40691d 7041->7043 7044 4068ff DeleteCriticalSection 7042->7044 7047 4064f3 7042->7047 7043->7040 7044->7043 7048 4064fc RaiseException 7047->7048 7049 40650b moneypunct 7047->7049 7048->7049 7049->7044 7050 4092ff 7053 404f03 7050->7053 7054 404f0f 7053->7054 7055 404f16 7053->7055 7055->7054 7056 404074 16 API calls 7055->7056 7056->7054 6819 408e00 6820 40778f ctype 4 API calls 6819->6820 6821 408e08 moneypunct 6820->6821 7057 406480 KillTimer PostQuitMessage 7191 403b00 7192 403b19 7191->7192 7195 403b0f 7191->7195 7193 403b41 SysStringLen 7192->7193 7192->7195 7194 403b51 SysStringByteLen CoTaskMemAlloc 7193->7194 7193->7195 7194->7195 7196 403b77 7194->7196 7197 401ca1 2 API calls 7196->7197 7197->7195 7287 401181 IsDialogMessageW 6822 401003 PostQuitMessage 6823 40aa03 6824 40aa15 LeaveCriticalSection 6823->6824 6825 40aa1e __get_sse2_info 6824->6825 6826 403010 GetDC 6827 403027 6826->6827 6829 40302e ReleaseDC 6826->6829 6829->6827 6830 40ac10 6831 40ac48 6830->6831 6832 40ac3b 6830->6832 6834 40ab6a __invoke_watson 5 API calls 6831->6834 6833 40ab6a __invoke_watson 5 API calls 6832->6833 6833->6831 6838 40ac58 __except_handler4 6834->6838 6835 40acdf 6836 40acb4 __except_handler4 6836->6835 6837 40accf 6836->6837 6839 40ab6a __invoke_watson 5 API calls 6836->6839 6840 40ab6a __invoke_watson 5 API calls 6837->6840 6838->6835 6838->6836 6843 40acf5 __except_handler4 6838->6843 6839->6837 6840->6835 6842 40ad34 __except_handler4 6844 40ad6b 6842->6844 6845 40ab6a __invoke_watson 5 API calls 6842->6845 6848 40d07a RtlUnwind 6843->6848 6846 40ab6a __invoke_watson 5 API calls 6844->6846 6845->6844 6847 40ad7b @_EH4_CallFilterFunc@8 6846->6847 6849 40d08f 6848->6849 6849->6842 7297 401590 7298 4015a9 7297->7298 7299 40161a OleInitialize GetWindowTextLengthW 7297->7299 7300 4015b0 7298->7300 7301 4015fa GetWindowLongW 7298->7301 7302 40164c 7299->7302 7309 401639 __alloca_probe_16 7299->7309 7304 40178c DefWindowProcW 7300->7304 7308 4015c6 GetWindowLongW 7300->7308 7305 401609 7301->7305 7306 40160f OleUninitialize 7301->7306 7333 40a609 HeapAlloc 7302->7333 7307 40166d 7304->7307 7305->7306 7306->7304 7310 40ab6a __invoke_watson 5 API calls 7307->7310 7308->7304 7311 4015e0 GetWindowLongW SetWindowLongW 7308->7311 7313 401676 GetWindowTextW SetWindowTextW 7309->7313 7314 401667 7309->7314 7312 4017ae 7310->7312 7311->7304 7315 4016a7 GlobalAlloc 7313->7315 7316 40169e 7313->7316 7317 40100e __freea HeapFree 7314->7317 7318 4016b9 7315->7318 7319 4016eb 7315->7319 7316->7315 7317->7307 7318->7319 7320 4016bd GlobalLock 7318->7320 7323 406144 18 API calls 7319->7323 7321 401082 __VEC_memcpy 7320->7321 7322 4016d4 GlobalUnlock CreateStreamOnHGlobal 7321->7322 7322->7319 7324 401712 7323->7324 7325 401719 7324->7325 7327 401755 SetWindowLongW 7324->7327 7326 401125 HeapFree 7325->7326 7326->7314 7328 40176a 7327->7328 7329 401125 HeapFree 7328->7329 7330 401778 7329->7330 7331 40100e __freea HeapFree 7330->7331 7332 40178b 7331->7332 7332->7304 7333->7309 7058 40a691 DebugBreak 7198 409314 7199 404f41 17 API calls 7198->7199 7200 409330 7199->7200 7201 402916 7202 403f49 7201->7202 7205 4014d0 SysFreeString 7202->7205 7204 403f51 moneypunct 7206 4014e9 7205->7206 7207 40158e 7206->7207 7208 40a212 ctype 3 API calls 7206->7208 7207->7204 7208->7207 6850 405817 6851 405829 6850->6851 6855 405822 6850->6855 6852 40a687 HeapAlloc 6851->6852 6853 405834 6852->6853 6853->6855 6856 403f8f 6853->6856 6857 403fa1 6856->6857 6861 403fcd moneypunct 6856->6861 6858 40a687 HeapAlloc 6857->6858 6860 403fc2 6858->6860 6860->6861 6862 402933 6860->6862 6861->6855 6863 40293b 6862->6863 6864 40294d 6863->6864 6865 401029 RaiseException 6863->6865 6864->6860 6865->6864 6866 402219 6867 40222e 6866->6867 6874 402227 6866->6874 6875 401ec2 ClientToScreen 6867->6875 6870 402263 6881 401e98 MoveWindow 6870->6881 6871 402254 6878 401ee8 ScreenToClient 6871->6878 6876 401ee2 GetParent 6875->6876 6877 401eda ClientToScreen 6875->6877 6876->6870 6876->6871 6877->6876 6879 401f00 ScreenToClient 6878->6879 6880 401f08 6878->6880 6879->6880 6880->6870 6881->6874 7334 405999 7335 4059fc 7334->7335 7336 4059b5 7334->7336 7340 404ea1 7336->7340 7338 4059c0 7338->7335 7339 403f8f 2 API calls 7338->7339 7339->7335 7341 404eb1 7340->7341 7345 404eaa 7340->7345 7342 40a687 HeapAlloc 7341->7342 7343 404ec2 7342->7343 7344 40291e InitializeCriticalSection 7343->7344 7343->7345 7344->7345 7345->7338 7059 40229b 7060 4022a2 SetCapture 7059->7060 7061 4022b7 ReleaseCapture 7059->7061 7062 4022c5 7060->7062 7061->7062 6882 408e1c 6883 408e42 6882->6883 6887 408e71 6883->6887 6888 4087ba 6883->6888 6884 40ab6a __invoke_watson 5 API calls 6885 408ebc 6884->6885 6887->6884 6889 4087dc 6888->6889 6890 4087e6 VariantInit 6888->6890 6889->6887 6892 408872 6890->6892 6893 408875 DispCallFunc VariantClear 6890->6893 6892->6893 6893->6889 7346 40819d 7347 404bc1 3 API calls 7346->7347 7348 4081a8 7347->7348 7349 4081e5 7348->7349 7350 401e3a 18 API calls 7348->7350 7351 4081ca SetWindowLongW 7350->7351 7351->7349 6895 40361e 6896 403628 6895->6896 6897 40363b 6896->6897 6898 40a212 ctype 3 API calls 6896->6898 6898->6897 7063 4058a0 7064 404f03 16 API calls 7063->7064 7065 4058b2 7064->7065 7352 4011a0 SetTimer 7209 404926 InterlockedIncrement 6078 405027 6079 40503c 6078->6079 6090 405059 6078->6090 6089 40504a 6079->6089 6097 402cab 6079->6097 6084 405396 6091 403872 6084->6091 6085 40516e 6085->6089 6085->6090 6117 403d92 6085->6117 6089->6084 6089->6085 6089->6090 6128 402b95 6089->6128 6131 404261 6089->6131 6135 4037cb 6089->6135 6092 40387a 6091->6092 6142 4025ce CallWindowProcW 6092->6142 6094 403893 6095 403691 ctype DestroyAcceleratorTable 6094->6095 6096 40389a 6095->6096 6098 402cca BeginPaint 6097->6098 6099 402d2b 6097->6099 6100 402e0e 6098->6100 6101 402ce2 GetClientRect CreateSolidBrush 6098->6101 6099->6100 6102 402d38 BeginPaint 6099->6102 6107 40ab6a __invoke_watson 5 API calls 6100->6107 6103 402d01 FillRect 6101->6103 6104 402d16 EndPaint 6101->6104 6102->6100 6105 402d52 GetClientRect CreateCompatibleBitmap 6102->6105 6106 402d10 DeleteObject 6103->6106 6104->6100 6105->6104 6108 402d7b CreateCompatibleDC 6105->6108 6106->6104 6109 402e1f 6107->6109 6110 402e06 6108->6110 6111 402d88 SelectObject 6108->6111 6109->6089 6110->6106 6112 402d99 CreateSolidBrush 6111->6112 6113 402dff DeleteDC 6111->6113 6114 402df5 SelectObject 6112->6114 6115 402dac FillRect DeleteObject 6112->6115 6113->6110 6114->6113 6116 402ddc BitBlt 6115->6116 6116->6114 6118 403da5 6117->6118 6125 403e00 6117->6125 6119 403db1 6118->6119 6120 403de5 6118->6120 6127 403dac 6118->6127 6122 403e9b SendMessageW 6119->6122 6123 403e5b 6119->6123 6120->6119 6121 403dea IsWindow 6120->6121 6121->6119 6121->6123 6122->6123 6123->6085 6124 403e46 GetDlgItem 6124->6119 6125->6119 6125->6123 6143 403200 6125->6143 6127->6119 6127->6123 6127->6124 6129 40253c 7 API calls 6128->6129 6130 402be2 6129->6130 6130->6089 6132 4042cc 6131->6132 6134 40427a 6131->6134 6133 4037cb 4 API calls 6132->6133 6133->6134 6134->6089 6136 403865 6135->6136 6141 4037e6 6135->6141 6136->6089 6137 40383a 6139 40385f SetFocus 6137->6139 6138 40383f GetFocus IsChild 6138->6136 6140 403853 GetWindow 6138->6140 6139->6136 6140->6139 6141->6137 6141->6138 6142->6094 6144 403217 6143->6144 6145 403209 6143->6145 6144->6127 6147 4025ce CallWindowProcW 6145->6147 6147->6144 6901 406c29 InterlockedDecrement 7066 40a4aa 7069 40a345 7066->7069 7070 40a355 7069->7070 7071 40a34e 7069->7071 7070->7071 7072 40a388 7070->7072 7077 40a304 7070->7077 7073 40a2e7 HeapFree 7072->7073 7075 40a391 DeleteCriticalSection 7073->7075 7075->7071 7078 40a319 RaiseException 7077->7078 7079 40a30c 7077->7079 7079->7078 7080 40a311 UnregisterClassA 7079->7080 7080->7070 7080->7072 6416 4060af 6417 4060bb 6416->6417 6418 4060c2 6416->6418 6418->6417 6420 405f8f 6418->6420 6421 405fa0 6420->6421 6426 405f6f 6421->6426 6438 405a4a 6426->6438 6429 404d11 6430 401e3a 18 API calls 6429->6430 6431 404d23 6430->6431 6432 404d33 6431->6432 6433 404d27 SetLastError 6431->6433 6434 404d2f 6432->6434 6435 404b61 4 API calls 6432->6435 6433->6434 6434->6417 6437 404d49 CreateWindowExW 6435->6437 6437->6434 6439 405ada 6438->6439 6440 405a5c 6438->6440 6439->6429 6440->6439 6441 405a79 EnterCriticalSection 6440->6441 6442 405a94 6441->6442 6456 405b6f 6441->6456 6444 405b03 LoadCursorW 6442->6444 6445 405a9b GetClassInfoExW 6442->6445 6443 40145c LeaveCriticalSection 6443->6439 6447 405ae2 6444->6447 6446 405ac0 GetClassInfoExW 6445->6446 6445->6447 6446->6447 6448 405ad2 6446->6448 6451 405b41 GetClassInfoExW 6447->6451 6457 404af7 6447->6457 6450 40145c LeaveCriticalSection 6448->6450 6450->6439 6453 405b66 6451->6453 6451->6456 6461 404c88 6453->6461 6456->6443 6458 404b05 6457->6458 6466 404ac6 6458->6466 6460 404b2c 6460->6451 6462 404c93 6461->6462 6463 404cb5 6461->6463 6462->6463 6464 404c99 RegisterClassExW 6462->6464 6463->6456 6465 4017b2 4 API calls 6464->6465 6465->6463 6469 40aea4 6466->6469 6468 404add 6468->6460 6472 40ada6 6469->6472 6473 40adb2 @x64tow_s@24 __aulldvrm 6472->6473 6475 40adc6 6473->6475 6476 40d2e7 6473->6476 6475->6468 6479 40a72d GetModuleHandleA 6476->6479 6478 40d2f5 __invoke_watson 6480 40a74c 6479->6480 6481 40a73c GetProcAddress 6479->6481 6480->6478 6481->6480 7210 403f30 7213 4025b9 7210->7213 7214 4025c2 DeleteCriticalSection 7213->7214 7215 4025cd 7213->7215 7214->7215 7083 403ab1 7084 403ac7 7083->7084 7085 403af8 7083->7085 7089 40295e StringFromGUID2 SysAllocString 7084->7089 7090 4029a4 7089->7090 7091 40299a 7089->7091 7093 40ab6a __invoke_watson 5 API calls 7090->7093 7092 401029 RaiseException 7091->7092 7092->7090 7094 4029b1 SysFreeString 7093->7094 7094->7085 6902 402432 InvalidateRect 7217 403134 7220 4025ce CallWindowProcW 7217->7220 7219 40314b 7220->7219 7221 409334 7222 409351 7221->7222 7223 404f03 16 API calls 7222->7223 7224 4093a3 7223->7224 7226 4093a9 7224->7226 7227 408a0c 7224->7227 7228 408a26 7227->7228 7230 408a1c 7227->7230 7228->7230 7231 40895a 7228->7231 7230->7226 7232 408965 7231->7232 7234 40896f 7231->7234 7233 401029 RaiseException 7232->7233 7233->7234 7235 40895a RaiseException 7234->7235 7236 4089c4 7234->7236 7235->7236 7236->7228 7095 4058b5 7098 404f41 7095->7098 7097 4058d1 7099 404f51 7098->7099 7100 404f5e 7099->7100 7101 404074 16 API calls 7099->7101 7102 404f6f lstrlenW 7100->7102 7103 404f83 _memcmp 7100->7103 7101->7100 7102->7103 7103->7097 7237 404937 InterlockedDecrement 7238 40494d 7237->7238 6148 406238 6149 406251 6148->6149 6150 4062c2 OleInitialize GetWindowTextLengthW 6148->6150 6151 4062a2 GetWindowLongW 6149->6151 6152 406258 6149->6152 6153 4062f4 6150->6153 6161 4062e1 __alloca_probe_16 6150->6161 6156 4062b1 6151->6156 6157 4062b7 OleUninitialize 6151->6157 6155 40645a DefWindowProcW 6152->6155 6159 40626e GetWindowLongW 6152->6159 6193 40a609 HeapAlloc 6153->6193 6160 406315 6155->6160 6156->6157 6157->6155 6158 4062fa 6158->6161 6159->6155 6162 406288 GetWindowLongW SetWindowLongW 6159->6162 6163 40ab6a __invoke_watson 5 API calls 6160->6163 6164 40631e GetWindowTextW SetWindowTextW 6161->6164 6178 40630f 6161->6178 6162->6155 6165 40647c 6163->6165 6166 406346 6164->6166 6167 40634f GlobalAlloc 6164->6167 6166->6167 6168 406361 6167->6168 6169 406393 6167->6169 6168->6169 6171 406365 GlobalLock 6168->6171 6172 401235 11 API calls 6169->6172 6173 401082 __VEC_memcpy 6171->6173 6174 4063a2 6172->6174 6175 40637c GlobalUnlock CreateStreamOnHGlobal 6173->6175 6176 4063a8 SysFreeString 6174->6176 6190 406214 6174->6190 6175->6169 6176->6178 6194 40100e 6178->6194 6181 4063ec 6182 401125 HeapFree 6181->6182 6182->6176 6183 406421 SetWindowLongW 6184 406435 6183->6184 6185 401125 HeapFree 6184->6185 6186 40643d SysFreeString 6185->6186 6187 40644b 6186->6187 6188 40100e __freea HeapFree 6187->6188 6189 406459 6188->6189 6189->6155 6191 406144 18 API calls 6190->6191 6192 406234 6191->6192 6192->6181 6192->6183 6193->6158 6195 401016 6194->6195 6196 401027 6194->6196 6195->6196 6197 40a66d __freea HeapFree 6195->6197 6196->6160 6197->6196 6903 406c38 6904 406c48 6903->6904 6906 406c41 6903->6906 6905 406c53 CoCreateInstance 6904->6905 6904->6906 6905->6906 7239 40d738 7244 4068a5 7239->7244 7242 40a966 7 API calls 7243 40d75f 7242->7243 7245 4068b3 7244->7245 7246 401ce1 InitializeCriticalSection 7245->7246 7247 4068ce 7246->7247 7247->7242 7353 402fba 7356 4029b5 7353->7356 7357 4029c3 SysFreeString 7356->7357 7358 4029e5 7356->7358 7357->7358 7359 4029ce SysAllocString 7357->7359 7359->7358 7360 4029db 7359->7360 7361 401029 RaiseException 7360->7361 7361->7358 6907 40983c 6908 40986d 6907->6908 6909 401ce1 InitializeCriticalSection 6908->6909 6910 409875 6909->6910 6912 4098be 6910->6912 6915 4078c4 9 API calls 6910->6915 6925 409883 6910->6925 6911 40751f ctype 6 API calls 6913 40988d 6911->6913 6917 4098d3 GetModuleFileNameW 6912->6917 6912->6925 6914 40ab6a __invoke_watson 5 API calls 6913->6914 6916 40989e 6914->6916 6915->6910 6918 4098f5 6917->6918 6919 409909 6917->6919 6920 401d2c GetLastError 6918->6920 6921 40990d 6919->6921 6922 40991f 6919->6922 6923 4098fa 6920->6923 6924 401125 HeapFree 6921->6924 6926 40993b GetModuleHandleW 6922->6926 6927 40994c 6922->6927 6928 401125 HeapFree 6923->6928 6924->6925 6925->6911 6926->6927 6929 409947 6926->6929 6930 401ca1 2 API calls 6927->6930 6928->6925 6934 4078c4 9 API calls 6929->6934 6931 40996a 6930->6931 6932 409971 6931->6932 6933 409983 lstrlenW 6931->6933 6935 401125 HeapFree 6932->6935 6933->6929 6936 4099ba 6934->6936 6935->6925 6936->6923 6937 4078c4 9 API calls 6936->6937 6938 4099d6 6937->6938 6938->6923 6939 4099e0 6938->6939 6940 409a04 6939->6940 6944 40955c 6939->6944 6950 4095de 6940->6950 6943 409a0e 6943->6943 6945 409567 6944->6945 6946 40940c 66 API calls 6945->6946 6947 409580 6946->6947 6948 401125 HeapFree 6947->6948 6949 40958a 6948->6949 6949->6940 6951 4095e9 6950->6951 6952 40940c 66 API calls 6951->6952 6953 409602 6952->6953 6954 401125 HeapFree 6953->6954 6955 40960c 6954->6955 6955->6943 7362 4011bf DestroyWindow PostQuitMessage 7363 40a3bf DeleteCriticalSection

                                                                                                                                                                Executed Functions

                                                                                                                                                                Function 00409D65 Relevance: 25.8, APIs: 17, Instructions: 273memoryCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 151 409d65-409d99 FindResourceW 152 409db2-409dbf FindResourceW 151->152 153 409d9b-409da6 LoadResource 151->153 155 40a060-40a067 152->155 156 409dc5-409dd0 LoadResource 152->156 153->152 154 409da8-409daf LockResource 153->154 154->152 157 409dd6-409de1 LockResource 156->157 158 40a058-40a05d call 401d2c 156->158 157->158 160 409de7-409e23 call 406577 call 40658b GetWindow 157->160 158->155 160->155 166 409e29-409e2d 160->166 167 409e34 166->167 168 409e2f-409e32 166->168 169 409e38-409e45 call 40843c 167->169 168->169 172 409e4b-409e67 call 4083fe 169->172 173 409ffd-40a002 169->173 179 409ea5-409ebc call 401235 172->179 180 409e69-409e76 GlobalAlloc 172->180 175 40a012-40a02a call 40660b 173->175 176 40a004-40a00f GetWindow 173->176 175->166 185 40a030 175->185 176->175 190 409ec2-409ed3 call 40194e 179->190 191 409fe5-409ff3 SysFreeString 179->191 182 40a032-40a03e 180->182 183 409e7c-409e9f GlobalLock call 401082 GlobalUnlock CreateStreamOnHGlobal 180->183 188 40a04e 182->188 183->179 185->155 188->155 192 40a050-40a056 188->192 198 409ed5 190->198 199 409ed8-409edd 190->199 191->175 193 409ff5-409ffb 191->193 192->155 193->175 198->199 200 409ee5 199->200 201 409edf-409ee3 199->201 202 409ee9-409ef1 200->202 201->202 203 409ef3-409ef7 202->203 204 409ef9 202->204 205 409efd-409f05 203->205 204->205 206 409f07-409f0b 205->206 207 409f0d 205->207 208 409f11-409f1b 206->208 207->208 209 409f23 208->209 210 409f1d-409f21 208->210 211 409f27-409f41 MapDialogRect 209->211 210->211 212 409f43-409f46 211->212 213 409f48 211->213 214 409f4c-409f4e 212->214 213->214 215 409f50-409f53 214->215 216 409f55 214->216 217 409f57-409f5b 215->217 216->217 218 409f62 217->218 219 409f5d-409f60 217->219 220 409f64-409f83 call 40868e 218->220 219->220 222 409f88-409f8d 220->222 223 409fdd-409fe2 call 401d2c 222->223 224 409f8f-409f92 222->224 223->191 226 409fa2-409fb9 call 409d44 224->226 227 409f94-409f98 224->227 232 40a040-40a04c SysFreeString 226->232 233 409fbf-409fc3 226->233 227->226 229 409f9a-409f9c SetWindowContextHelpId 227->229 229->226 232->188 234 409fc5 233->234 235 409fc8-409fdb SetWindowPos 233->235 234->235 235->191
                                                                                                                                                                APIs
                                                                                                                                                                • FindResourceW.KERNEL32(?,000000F0), ref: 00409D87
                                                                                                                                                                • LoadResource.KERNEL32(00000000), ref: 00409DA2
                                                                                                                                                                • GetWindow.USER32(?,00000002), ref: 0040A009
                                                                                                                                                                • LockResource.KERNEL32(00000000), ref: 00409DA9
                                                                                                                                                                  • Part of subcall function 00401D2C: GetLastError.KERNEL32(0040948F), ref: 00401D2C
                                                                                                                                                                • FindResourceW.KERNEL32(?,00000005), ref: 00409DBB
                                                                                                                                                                • LoadResource.KERNEL32(00000000), ref: 00409DCC
                                                                                                                                                                • LockResource.KERNEL32(00000000), ref: 00409DD7
                                                                                                                                                                • GetWindow.USER32(?,00000005), ref: 00409E13
                                                                                                                                                                • GlobalAlloc.KERNEL32(00000042,00000000), ref: 00409E6C
                                                                                                                                                                • GlobalLock.KERNEL32(00000000), ref: 00409E7D
                                                                                                                                                                • GlobalUnlock.KERNEL32(00000000), ref: 00409E92
                                                                                                                                                                • CreateStreamOnHGlobal.OLE32(00000000,00000001,00000000), ref: 00409E9F
                                                                                                                                                                • MapDialogRect.USER32(00000000,?), ref: 00409F39
                                                                                                                                                                • SetWindowContextHelpId.USER32(00000000,00000000), ref: 00409F9C
                                                                                                                                                                • SetWindowPos.USER32(00000000,?,00000000,00000000,00000000,00000000,00000013,?,00000000,00000000,00000000), ref: 00409FD2
                                                                                                                                                                • SysFreeString.OLEAUT32(00000000), ref: 00409FE8
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Resource$GlobalWindow$Lock$FindLoad$AllocContextCreateDialogErrorFreeHelpLastRectStreamStringUnlock
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2331680014-0
                                                                                                                                                                • Opcode ID: 9a63fbb2dd714ba350ba2e888deb5622258a00963ab25326d0d189ca7ae26512
                                                                                                                                                                • Instruction ID: b32264a182df8b8185a25ae9e4a093f941d12f3cf307d36edcfa630756bfb5d0
                                                                                                                                                                • Opcode Fuzzy Hash: 9a63fbb2dd714ba350ba2e888deb5622258a00963ab25326d0d189ca7ae26512
                                                                                                                                                                • Instruction Fuzzy Hash: CDA1AC71900209EBDB209FA1DD44ABFBBB9EF44701F14842AF845F62E1E7399D40DB69
                                                                                                                                                                Function 0040A2BF Relevance: 10.6, APIs: 7, Instructions: 59memoryCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 336 40a2bf 338 40a232-40a23a 336->338 339 40a229-40a230 call 40a15d 336->339 341 40a253-40a25c RtlInterlockedPopEntrySList 338->341 342 40a23c-40a24f GetProcessHeap HeapAlloc 338->342 339->338 345 40a275-40a278 339->345 346 40a2bd-40a2be 341->346 347 40a25e-40a273 VirtualAlloc 341->347 344 40a251-40a252 342->344 342->345 347->345 348 40a279-40a28c RtlInterlockedPopEntrySList 347->348 349 40a2a0 348->349 350 40a28e-40a29e VirtualFree 348->350 352 40a2a6-40a2b8 RtlInterlockedPushEntrySList 349->352 351 40a2bc 350->351 351->346 352->352 353 40a2ba 352->353 353->351
                                                                                                                                                                APIs
                                                                                                                                                                • GetProcessHeap.KERNEL32(00000000,0000000D,00000014,00401E47,00000000,004081CA,00000000,00000000,?,?,004102E0), ref: 0040A240
                                                                                                                                                                • HeapAlloc.KERNEL32(00000000,?,?,004102E0), ref: 0040A247
                                                                                                                                                                  • Part of subcall function 0040A15D: IsProcessorFeaturePresent.KERNEL32(0000000C,?,0040A22E,00000014,00401E47,00000000,004081CA,00000000,00000000,?,?,004102E0), ref: 0040A160
                                                                                                                                                                • RtlInterlockedPopEntrySList.NTDLL(006865F8), ref: 0040A254
                                                                                                                                                                • VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,?,004102E0), ref: 0040A269
                                                                                                                                                                • RtlInterlockedPopEntrySList.NTDLL(00000014), ref: 0040A282
                                                                                                                                                                • VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,004102E0), ref: 0040A296
                                                                                                                                                                • RtlInterlockedPushEntrySList.NTDLL(00000000), ref: 0040A2AD
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: EntryInterlockedList$AllocHeapVirtual$FeatureFreePresentProcessProcessorPush
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2304957937-0
                                                                                                                                                                • Opcode ID: 4eef6948829efe3343bb29585dc7892d8ee7b201fb463e6bf931d3ddf1ee949c
                                                                                                                                                                • Instruction ID: 07394e22955033af2d43ad660e51909c4cc8c1264f72119093e848aa411fdedd
                                                                                                                                                                • Opcode Fuzzy Hash: 4eef6948829efe3343bb29585dc7892d8ee7b201fb463e6bf931d3ddf1ee949c
                                                                                                                                                                • Instruction Fuzzy Hash: 2C11C831240320EBDB611B64BC0CF9A3759AB44741F1444BAFA49F63E0DBF98CA1865E
                                                                                                                                                                Function 00406238 Relevance: 30.2, APIs: 20, Instructions: 208comCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                • GetWindowLongW.USER32(?,000000EC), ref: 00406279
                                                                                                                                                                • GetWindowLongW.USER32(?,000000EC), ref: 0040628D
                                                                                                                                                                • SetWindowLongW.USER32(?,000000EC,00000000), ref: 00406297
                                                                                                                                                                • GetWindowLongW.USER32(?,000000EB), ref: 004062A7
                                                                                                                                                                • OleUninitialize.OLE32 ref: 004062B7
                                                                                                                                                                • OleInitialize.OLE32(00000000), ref: 004062C5
                                                                                                                                                                • GetWindowTextLengthW.USER32(?), ref: 004062CE
                                                                                                                                                                • __alloca_probe_16.LIBCMT ref: 004062E1
                                                                                                                                                                • __freea.LIBCMT ref: 00406310
                                                                                                                                                                • DefWindowProcW.USER32(?,?,?,?), ref: 00406466
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Window$Long$InitializeLengthProcTextUninitialize__alloca_probe_16__freea
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 28949450-0
                                                                                                                                                                • Opcode ID: 8aa04fe590e36e3a70198cffcadc8070c0d19e8d623510fa997590622132b48b
                                                                                                                                                                • Instruction ID: 9722be613339ca3db09fd7b727bd1f44c9c3ac900b7060599eb43628a4f9981e
                                                                                                                                                                • Opcode Fuzzy Hash: 8aa04fe590e36e3a70198cffcadc8070c0d19e8d623510fa997590622132b48b
                                                                                                                                                                • Instruction Fuzzy Hash: F771AE31900109AFDF00AFA5CD88DAE7BB9EF04314B11497EF906F62A1CB389D61CB59
                                                                                                                                                                Function 004054A5 Relevance: 30.1, APIs: 16, Strings: 1, Instructions: 302COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 64 4054a5-4054b1 65 4054b3-4054b8 64->65 66 4054bd-4054e5 call 403691 64->66 67 40578c-40578e 65->67 70 405504-40550f IsWindow 66->70 71 4054e7-4054ea 66->71 73 405515-40551a 70->73 74 405787-40578b 70->74 71->70 72 4054ec-4054ff RedrawWindow call 40319c 71->72 72->70 76 405529-405530 73->76 77 40551c-405525 call 40317c 73->77 74->67 79 405532-40553b call 401f0e 76->79 80 40554f-40556c call 40348a 76->80 77->76 88 405541 79->88 89 40553d-40553f 79->89 86 405580-405591 80->86 87 40556e-405578 call 4044a7 80->87 91 405755-405764 call 403691 86->91 92 405597-40559b 86->92 94 40557d 87->94 93 405543-405549 GetSysColor 88->93 89->93 91->74 103 405766-405777 RedrawWindow 91->103 96 4055b3-4055b7 92->96 97 40559d-4055a0 92->97 93->80 94->86 100 405748-40574b 96->100 101 4055bd-4055bf 96->101 97->96 99 4055a2-4055ae call 40333c 97->99 99->96 100->91 102 40574d-405753 100->102 101->100 105 4055c5-4055d9 GetWindowLongW 101->105 102->74 102->91 103->74 106 405779-40577d 103->106 107 4055e7-40560c GetWindowLongW SetWindowLongW SetWindowPos 105->107 108 4055db-4055e5 105->108 106->74 110 40577f-405782 call 40319c 106->110 109 405612-405626 call 402645 107->109 108->109 114 405632-40563a 109->114 115 405628-40562c 109->115 110->74 117 405646-40564e 114->117 118 40563c-405640 114->118 115->114 116 40579a-4057b1 115->116 124 4057b3-405806 VariantInit call 4029ef VariantClear * 2 116->124 125 40573b-405740 116->125 119 405650-405654 117->119 120 40565a-405662 117->120 118->116 118->117 119->116 119->120 122 405664-405668 120->122 123 40566e-405676 120->123 122->116 122->123 126 405682-40568a 123->126 127 405678-40567c 123->127 124->125 143 40580c-405812 124->143 125->100 128 405742-405744 125->128 130 405696-40569b 126->130 131 40568c-405690 126->131 127->116 127->126 128->100 130->116 133 4056a1-4056b9 lstrlenW GlobalAlloc 130->133 131->116 131->130 134 405791-405798 133->134 135 4056bf-4056f2 GlobalLock call 401082 GlobalUnlock CreateStreamOnHGlobal 133->135 138 405739 134->138 140 4056f4-40570e 135->140 141 40572c-405731 135->141 138->125 146 405710-40571c 140->146 147 40571f-405724 140->147 141->138 144 405733-405735 141->144 143->125 144->138 146->147 147->141 149 405726-405728 147->149 149->141
                                                                                                                                                                APIs
                                                                                                                                                                • RedrawWindow.USER32(?,00000000,00000000,00000507), ref: 004054F6
                                                                                                                                                                • IsWindow.USER32(?), ref: 00405507
                                                                                                                                                                • GetSysColor.USER32(00000005), ref: 00405543
                                                                                                                                                                • GetWindowLongW.USER32(?,000000F0), ref: 004055D2
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Window$ColorLongRedraw
                                                                                                                                                                • String ID: t@
                                                                                                                                                                • API String ID: 4056730343-2916730932
                                                                                                                                                                • Opcode ID: 2472e1211d9bdd42d287035a8e9e656ac211c83ecab8aeb96341efffc71a24dc
                                                                                                                                                                • Instruction ID: a44568e81ff579c681077a249f66688bf6b6d7c62f676c4b8034998814c2c4d3
                                                                                                                                                                • Opcode Fuzzy Hash: 2472e1211d9bdd42d287035a8e9e656ac211c83ecab8aeb96341efffc71a24dc
                                                                                                                                                                • Instruction Fuzzy Hash: 8AB16674900609EBDB109F69CC44BAF77B9EF44314F54886AF845AB2D0CB39AE51DF28
                                                                                                                                                                Function 004081EB Relevance: 18.1, APIs: 12, Instructions: 79COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 0040194E: EnterCriticalSection.KERNEL32(004102E4,75BFA7D0,0041025C,?,?,?,?,?,?,?,00409B2E,00000000,?,00000000,?,0040AACE), ref: 00401960
                                                                                                                                                                  • Part of subcall function 0040194E: RegisterWindowMessageW.USER32(WM_ATLGETHOST,?,?,?,?,?,?,?,00409B2E,00000000,?,00000000,?,0040AACE,00000000), ref: 00401975
                                                                                                                                                                  • Part of subcall function 0040194E: RegisterWindowMessageW.USER32(WM_ATLGETCONTROL,?,?,?,?,?,?,?,00409B2E,00000000,?,00000000,?,0040AACE,00000000), ref: 00401981
                                                                                                                                                                  • Part of subcall function 0040194E: GetClassInfoExW.USER32(AtlAxWin80,?), ref: 0040199E
                                                                                                                                                                  • Part of subcall function 0040194E: LoadCursorW.USER32(00000000,00007F00), ref: 004019D2
                                                                                                                                                                  • Part of subcall function 0040194E: RegisterClassExW.USER32(?), ref: 004019EF
                                                                                                                                                                  • Part of subcall function 0040194E: _memset.LIBCMT ref: 00401A18
                                                                                                                                                                  • Part of subcall function 0040194E: GetClassInfoExW.USER32(AtlAxWinLic80,?), ref: 00401A33
                                                                                                                                                                  • Part of subcall function 0040194E: LoadCursorW.USER32(00000000,00007F00), ref: 00401A68
                                                                                                                                                                  • Part of subcall function 0040194E: RegisterClassExW.USER32(?), ref: 00401A85
                                                                                                                                                                • FindResourceW.KERNEL32(?,?,00000005,0041025C,00000000,?,75BFA7D0,0041025C), ref: 0040820D
                                                                                                                                                                • FindResourceW.KERNEL32(?,?,000000F0,?), ref: 00408226
                                                                                                                                                                • LoadResource.KERNEL32(?,00000000), ref: 0040823A
                                                                                                                                                                • LockResource.KERNEL32(00000000), ref: 0040823D
                                                                                                                                                                • LoadResource.KERNEL32(?), ref: 0040824B
                                                                                                                                                                • LockResource.KERNEL32(00000000), ref: 00408252
                                                                                                                                                                • CreateDialogIndirectParamW.USER32(?,00000000,?,?,?), ref: 00408273
                                                                                                                                                                • GetLastError.KERNEL32 ref: 00408281
                                                                                                                                                                • GlobalHandle.KERNEL32(00000000), ref: 00408290
                                                                                                                                                                • GlobalFree.KERNEL32(00000000), ref: 00408297
                                                                                                                                                                • GetLastError.KERNEL32 ref: 0040829F
                                                                                                                                                                • SetLastError.KERNEL32(?), ref: 004082B5
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Resource$ClassLoadRegister$ErrorLast$CursorFindGlobalInfoLockMessageWindow$CreateCriticalDialogEnterFreeHandleIndirectParamSection_memset
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2992142088-0
                                                                                                                                                                • Opcode ID: b34073fe35a2a4e5d7bae0d1118e0bbe55324e039accc3641cb14715aa09f1ff
                                                                                                                                                                • Instruction ID: 558fcba7b94dea7674d76278d1cd815747eb906cd404d6e5577c9207027ed8de
                                                                                                                                                                • Opcode Fuzzy Hash: b34073fe35a2a4e5d7bae0d1118e0bbe55324e039accc3641cb14715aa09f1ff
                                                                                                                                                                • Instruction Fuzzy Hash: BB21A171104715AFD711AF629E48A2FBBE8FF85710F050C3DF980B2250DB7998159AAA
                                                                                                                                                                Function 00409AE0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 54windowCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                • CoInitialize.OLE32(00000000), ref: 00409B00
                                                                                                                                                                • DefWindowProcW.USER32(00000000,00000000,00000000,00000000,?,0040AACE,00000000), ref: 00409B0A
                                                                                                                                                                  • Part of subcall function 00406533: InitCommonControlsEx.COMCTL32(?,?,?,?,00409B17,00000004,?,0040AACE,00000000), ref: 00406549
                                                                                                                                                                  • Part of subcall function 004069F4: GetCurrentThreadId.KERNEL32 ref: 00406A12
                                                                                                                                                                  • Part of subcall function 0040194E: EnterCriticalSection.KERNEL32(004102E4,75BFA7D0,0041025C,?,?,?,?,?,?,?,00409B2E,00000000,?,00000000,?,0040AACE), ref: 00401960
                                                                                                                                                                  • Part of subcall function 0040194E: RegisterWindowMessageW.USER32(WM_ATLGETHOST,?,?,?,?,?,?,?,00409B2E,00000000,?,00000000,?,0040AACE,00000000), ref: 00401975
                                                                                                                                                                  • Part of subcall function 0040194E: RegisterWindowMessageW.USER32(WM_ATLGETCONTROL,?,?,?,?,?,?,?,00409B2E,00000000,?,00000000,?,0040AACE,00000000), ref: 00401981
                                                                                                                                                                  • Part of subcall function 0040194E: GetClassInfoExW.USER32(AtlAxWin80,?), ref: 0040199E
                                                                                                                                                                  • Part of subcall function 0040194E: LoadCursorW.USER32(00000000,00007F00), ref: 004019D2
                                                                                                                                                                  • Part of subcall function 0040194E: RegisterClassExW.USER32(?), ref: 004019EF
                                                                                                                                                                  • Part of subcall function 0040194E: _memset.LIBCMT ref: 00401A18
                                                                                                                                                                  • Part of subcall function 0040194E: GetClassInfoExW.USER32(AtlAxWinLic80,?), ref: 00401A33
                                                                                                                                                                  • Part of subcall function 0040194E: LoadCursorW.USER32(00000000,00007F00), ref: 00401A68
                                                                                                                                                                  • Part of subcall function 0040194E: RegisterClassExW.USER32(?), ref: 00401A85
                                                                                                                                                                • CoUninitialize.OLE32(00000000,?,00000000,?,0040AACE,00000000), ref: 00409B44
                                                                                                                                                                • MessageBoxExW.USER32(00000000,This program will visit the given URL and exit.It is usually used for statistical purpose.Usage: stats.exe <URL>,Tip,00000030,00000002), ref: 00409B5E
                                                                                                                                                                Strings
                                                                                                                                                                • This program will visit the given URL and exit.It is usually used for statistical purpose.Usage: stats.exe <URL>, xrefs: 00409B58
                                                                                                                                                                • ://, xrefs: 00409AEB
                                                                                                                                                                • Tip, xrefs: 00409B53
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ClassRegister$MessageWindow$CursorInfoLoad$CommonControlsCriticalCurrentEnterInitInitializeProcSectionThreadUninitialize_memset
                                                                                                                                                                • String ID: ://$This program will visit the given URL and exit.It is usually used for statistical purpose.Usage: stats.exe <URL>$Tip
                                                                                                                                                                • API String ID: 1891423193-314159335
                                                                                                                                                                • Opcode ID: d57fe23e49e834b2d20f9d2c187af9b3d0480d896070174b39bf21266c81a33b
                                                                                                                                                                • Instruction ID: 5bc4b88b9a5656005c38049dd0c25c6740fd7e0a81772a24bde27d6abe2d5549
                                                                                                                                                                • Opcode Fuzzy Hash: d57fe23e49e834b2d20f9d2c187af9b3d0480d896070174b39bf21266c81a33b
                                                                                                                                                                • Instruction Fuzzy Hash: E001D432205225BBDA113BA6BC0AF9F7A1DAF45B60F10083FF600B10D2CA78592096ED
                                                                                                                                                                Function 0040348A Relevance: 10.6, APIs: 7, Instructions: 141comCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 270 40348a-4034a8 271 4034b4-4034c3 270->271 272 4034aa-4034af 270->272 274 4034c9-4034cf 271->274 275 40360f 271->275 273 403611-40361d call 40ab6a 272->273 274->275 276 4034d5-4034d9 274->276 275->273 278 4034e1-4034e9 276->278 279 4034db-4034df 276->279 282 4034f1-4034f9 278->282 283 4034eb-4034ef 278->283 279->278 281 403551-403560 call 401dc4 279->281 292 403571-40357d lstrlenW 281->292 293 403562-40356f 281->293 285 403501-403509 282->285 286 4034fb-4034ff 282->286 283->281 283->282 288 403511-403519 285->288 289 40350b-40350f 285->289 286->281 286->285 290 403521-403529 288->290 291 40351b-40351f 288->291 289->281 289->288 294 403531-403536 290->294 295 40352b-40352f 290->295 291->281 291->290 297 403583-40358c 292->297 298 40360a-40360d 292->298 296 403543-40354c CoCreateInstance 293->296 294->281 299 403538-40353e 294->299 295->281 295->294 300 403607 296->300 301 403596 CLSIDFromProgID 297->301 302 40358e-403594 CLSIDFromString 297->302 298->273 299->296 300->298 303 40359c-4035a3 301->303 302->303 303->298 304 4035a5-4035b0 SysStringLen 303->304 305 4035b2-4035d0 CoGetClassObject 304->305 306 4035f6-403601 CoCreateInstance 304->306 307 4035d2-4035e4 305->307 308 4035e7-4035ec 305->308 306->300 307->308 308->298 309 4035ee-4035f4 308->309 309->298
                                                                                                                                                                APIs
                                                                                                                                                                • CoCreateInstance.OLE32(0040E6A4,00000000,00000001,?), ref: 00403543
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateInstance
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 542301482-0
                                                                                                                                                                • Opcode ID: 0b3207350ccdb61446f3d3a50d273f5d01df4129bbf8d6a9d7d62144eceb9347
                                                                                                                                                                • Instruction ID: fa4264cd1955a41306a9d1c3a1fbf8da1e2f0e149bce503760d62e4bf295f703
                                                                                                                                                                • Opcode Fuzzy Hash: 0b3207350ccdb61446f3d3a50d273f5d01df4129bbf8d6a9d7d62144eceb9347
                                                                                                                                                                • Instruction Fuzzy Hash: 28418074900216AADF209F59CC45BBB7EBCEB08302F90443BE945B62E0D77D9E82875D
                                                                                                                                                                Function 0040AA2E Relevance: 10.6, APIs: 7, Instructions: 64COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 312 40aa2e-40aa40 GetCommandLineW 313 40aa42 312->313 314 40aa4a-40aa5c call 40a559 312->314 315 40aa44 ExitProcess 313->315 318 40aa79-40aa7d 314->318 319 40aa5e-40aa6a CharNextW 314->319 322 40aa97-40aa9d 318->322 323 40aa7f-40aa88 CharNextW 318->323 320 40aa92-40aa95 CharNextW 319->320 321 40aa6c-40aa6f 319->321 320->322 321->319 324 40aa71-40aa75 321->324 326 40aa8c-40aa90 322->326 327 40aa9f-40aab1 GetStartupInfoW 322->327 323->323 325 40aa8a 323->325 324->322 328 40aa77 324->328 325->322 326->320 326->327 329 40aab3-40aab7 327->329 330 40aab9-40aabb 327->330 328->320 331 40aabc-40aac9 GetModuleHandleA call 409ae0 329->331 330->331 333 40aace-40aad6 call 40a848 331->333 333->315
                                                                                                                                                                APIs
                                                                                                                                                                • GetCommandLineW.KERNEL32 ref: 0040AA36
                                                                                                                                                                • ExitProcess.KERNEL32 ref: 0040AA44
                                                                                                                                                                • CharNextW.USER32(00000000), ref: 0040AA5F
                                                                                                                                                                • CharNextW.USER32(00000000), ref: 0040AA80
                                                                                                                                                                • CharNextW.USER32(00000000), ref: 0040AA93
                                                                                                                                                                • GetStartupInfoW.KERNEL32(?), ref: 0040AAA7
                                                                                                                                                                • GetModuleHandleA.KERNEL32(00000000,00000000,00000000,0000000A), ref: 0040AAC2
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CharNext$CommandExitHandleInfoLineModuleProcessStartup
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 583095831-0
                                                                                                                                                                • Opcode ID: 737934e675de4f21d5852706c508735ecd86d95bc8679f7fef37f85b9d084f5a
                                                                                                                                                                • Instruction ID: c0e04138e1e23b9fdac12e1038fbc33ee6814bfcfad250fba7c6a6d4ce773015
                                                                                                                                                                • Opcode Fuzzy Hash: 737934e675de4f21d5852706c508735ecd86d95bc8679f7fef37f85b9d084f5a
                                                                                                                                                                • Instruction Fuzzy Hash: 03116335500321A6D731BBA68E08B7F76A49F00751F550537F881B22D1E7BC4DA2CAAF
                                                                                                                                                                Function 00404074 Relevance: 6.2, APIs: 4, Instructions: 152COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 354 404074-404098 355 4040a6-4040c7 EnterCriticalSection 354->355 356 40409a-40409d 354->356 358 4041f9 355->358 359 4040cd-4040e2 call 401c74 355->359 356->355 357 40409f-4040a1 356->357 362 40421f-404235 call 40ab6a 357->362 361 4041fc-404202 358->361 368 4040e4-4040ea 359->368 369 40413e-404159 LoadRegTypeLib 359->369 364 404214-40421c call 40145c 361->364 365 404204-404207 361->365 364->362 365->364 370 404209-404211 call 402a2e 365->370 368->369 372 4040ec-4040f2 368->372 374 40415c-40415f 369->374 370->364 372->369 376 4040f4-40410c GetModuleFileNameW 372->376 374->361 378 404165-40417c 374->378 376->361 379 404112-404114 376->379 382 4041e1-4041ef 378->382 383 40417e-40419f call 402645 378->383 379->361 380 40411a-404137 LoadTypeLib call 401125 379->380 390 40413c 380->390 382->361 389 4041f1-4041f7 382->389 393 4041a1-4041a8 call 403f65 383->393 394 4041ad-4041cc call 404058 383->394 389->361 390->374 393->394 398 4041d4-4041d9 394->398 399 4041ce-4041d0 394->399 398->382 400 4041db-4041dd 398->400 399->398 400->382
                                                                                                                                                                APIs
                                                                                                                                                                • EnterCriticalSection.KERNEL32(0041024C,00000000), ref: 004040B3
                                                                                                                                                                • GetModuleFileNameW.KERNEL32(?,00000104), ref: 00404104
                                                                                                                                                                • LoadTypeLib.OLEAUT32(?,?), ref: 0040412B
                                                                                                                                                                • LoadRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00404153
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: LoadType$CriticalEnterFileModuleNameSection
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3866656374-0
                                                                                                                                                                • Opcode ID: db21f10e629710586123d8f596d5cbfd9ffda8754c06c2071a621fa964ef6ed8
                                                                                                                                                                • Instruction ID: 823f8b2c91bdd8410441d022d75542e2a5c1e8dc3aa34007b3531f1e035e3835
                                                                                                                                                                • Opcode Fuzzy Hash: db21f10e629710586123d8f596d5cbfd9ffda8754c06c2071a621fa964ef6ed8
                                                                                                                                                                • Instruction Fuzzy Hash: 88513EB19003089FDB20DFA5CC889AEB7B9BF95304B20443EE546EB291DB399985CF14
                                                                                                                                                                Function 00405C5B Relevance: 6.0, APIs: 4, Instructions: 45COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 401 405c5b-405c90 GetDlgItem call 40194e call 401483 406 405c92-405cb6 VariantInit call 401207 401->406 407 405cda-405cdb 401->407 410 405cba-405cd2 SysFreeString VariantClear 406->410 410->407 411 405cd4-405cd6 410->411 411->407
                                                                                                                                                                APIs
                                                                                                                                                                • GetDlgItem.USER32(?,000003E8), ref: 00405C69
                                                                                                                                                                  • Part of subcall function 0040194E: EnterCriticalSection.KERNEL32(004102E4,75BFA7D0,0041025C,?,?,?,?,?,?,?,00409B2E,00000000,?,00000000,?,0040AACE), ref: 00401960
                                                                                                                                                                  • Part of subcall function 0040194E: RegisterWindowMessageW.USER32(WM_ATLGETHOST,?,?,?,?,?,?,?,00409B2E,00000000,?,00000000,?,0040AACE,00000000), ref: 00401975
                                                                                                                                                                  • Part of subcall function 0040194E: RegisterWindowMessageW.USER32(WM_ATLGETCONTROL,?,?,?,?,?,?,?,00409B2E,00000000,?,00000000,?,0040AACE,00000000), ref: 00401981
                                                                                                                                                                  • Part of subcall function 0040194E: GetClassInfoExW.USER32(AtlAxWin80,?), ref: 0040199E
                                                                                                                                                                  • Part of subcall function 0040194E: LoadCursorW.USER32(00000000,00007F00), ref: 004019D2
                                                                                                                                                                  • Part of subcall function 0040194E: RegisterClassExW.USER32(?), ref: 004019EF
                                                                                                                                                                  • Part of subcall function 0040194E: _memset.LIBCMT ref: 00401A18
                                                                                                                                                                  • Part of subcall function 0040194E: GetClassInfoExW.USER32(AtlAxWinLic80,?), ref: 00401A33
                                                                                                                                                                  • Part of subcall function 0040194E: LoadCursorW.USER32(00000000,00007F00), ref: 00401A68
                                                                                                                                                                  • Part of subcall function 0040194E: RegisterClassExW.USER32(?), ref: 00401A85
                                                                                                                                                                • VariantInit.OLEAUT32(?), ref: 00405C96
                                                                                                                                                                • SysFreeString.OLEAUT32(?), ref: 00405CBD
                                                                                                                                                                • VariantClear.OLEAUT32(?), ref: 00405CC7
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ClassRegister$CursorInfoLoadMessageVariantWindow$ClearCriticalEnterFreeInitItemSectionString_memset
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1310020280-0
                                                                                                                                                                • Opcode ID: e7acc18397d59e599054c78656186672f9ce1e491407c15093e1300ae225156b
                                                                                                                                                                • Instruction ID: fdcf524c0c651178066a945282049319c38ea5a882d9b15e1e7355379dc4a2b0
                                                                                                                                                                • Opcode Fuzzy Hash: e7acc18397d59e599054c78656186672f9ce1e491407c15093e1300ae225156b
                                                                                                                                                                • Instruction Fuzzy Hash: A30157B0900209FFDF00EFA0CD49DAEBB78FF44709F108469F905AA1A1CB349A56DB64
                                                                                                                                                                Function 004044A7 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 314COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 412 4044a7-4044b6 413 4044b8-4044ba 412->413 414 4044bf-4044e2 call 404c28 412->414 415 4047ee-4047f1 413->415 419 4047b2-4047c9 414->419 420 4044e8-4044fd 414->420 425 4047ea-4047ed 419->425 426 4047cb-4047e0 419->426 423 404527-40452b 420->423 424 4044ff-404516 call 403237 420->424 427 404531-404540 call 403256 423->427 428 4045de-4045e4 423->428 450 40451a-40451f 424->450 425->415 448 4047e2 426->448 440 404542-404548 427->440 441 40455c-404560 427->441 432 4045e6-404606 call 403237 428->432 433 40460e-40462a 428->433 432->433 467 404608-40460a 432->467 446 40464c-404656 433->446 447 40462c-40463e 433->447 442 404553 440->442 443 40454a-40454d 440->443 441->428 445 404562-404571 call 403275 441->445 455 404557-40455a 442->455 454 404551 443->454 462 4045d1-4045d6 445->462 463 404573-404584 445->463 453 404676-40469c call 403ef1 446->453 464 404640-40464a 447->464 465 404658-40466a 447->465 448->425 452 4047e4-4047e6 448->452 450->423 456 404521-404523 450->456 452->425 482 4046ab-4046c3 453->482 483 40469e-4046a7 453->483 454->455 461 40458c-404590 455->461 456->423 461->462 466 404592-404598 461->466 462->428 469 4045d8-4045da 462->469 463->461 478 404586-404588 463->478 464->453 465->453 475 40466c 465->475 470 4045a4-4045ac 466->470 471 40459a-4045a0 466->471 467->433 469->428 476 4045b6-4045bd 470->476 477 4045ae-4045b2 470->477 471->470 475->453 479 4045c7-4045cc 476->479 480 4045bf-4045c3 476->480 477->476 478->461 479->448 480->479 485 4047a2-4047a7 482->485 486 4046c9-40477e GetClientRect call 40253c call 4024bf call 403237 482->486 483->482 488 4047a9-4047ab 485->488 489 4047af 485->489 498 404782-40479a RedrawWindow 486->498 488->489 489->419 498->485 499 40479c-40479e 498->499 499->485
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID: AXWIN
                                                                                                                                                                • API String ID: 0-1948516679
                                                                                                                                                                • Opcode ID: 29b47ff977883ad234e927c2da6d7abc7687d5a6c2c032b68ea4efb225e3d3c3
                                                                                                                                                                • Instruction ID: 8a837ab6d25e92d74b3a4ad2e440ee3dab00f482d83e3c825d564be163418add
                                                                                                                                                                • Opcode Fuzzy Hash: 29b47ff977883ad234e927c2da6d7abc7687d5a6c2c032b68ea4efb225e3d3c3
                                                                                                                                                                • Instruction Fuzzy Hash: 25C118B4600205EFDB14DFA4C888FAAB7B9FF49304F104869F656EB290DB39E911CB54
                                                                                                                                                                Function 00409A13 Relevance: 3.1, APIs: 2, Instructions: 68timeCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 004080BF: EnterCriticalSection.KERNEL32(0041024C,0041025C,00000000,75BFA7D0,0041025C), ref: 004080D6
                                                                                                                                                                  • Part of subcall function 004080BF: GetCurrentThreadId.KERNEL32 ref: 004080DC
                                                                                                                                                                  • Part of subcall function 004080BF: LeaveCriticalSection.KERNEL32(0041024C,?,?), ref: 004080F8
                                                                                                                                                                • SetTimer.USER32(00000000,00000000,0001D4C0,00406480), ref: 00409AB0
                                                                                                                                                                • IsWindow.USER32(?), ref: 00409AC3
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CriticalSection$CurrentEnterLeaveThreadTimerWindow
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1852797959-0
                                                                                                                                                                • Opcode ID: 584e8c5aa9ba8231c555835d596f9efe1915d81030b337a812fc3b39fce041eb
                                                                                                                                                                • Instruction ID: 8fa7681320ebb0343f58c68049be1fe6cc87afb05af6ec14704baaf3ab520f0a
                                                                                                                                                                • Opcode Fuzzy Hash: 584e8c5aa9ba8231c555835d596f9efe1915d81030b337a812fc3b39fce041eb
                                                                                                                                                                • Instruction Fuzzy Hash: C1215E71A11218ABCB04EF66DC419EEBBB8BF44744F00443FF806B7291DB789A44CB99
                                                                                                                                                                Function 00404D11 Relevance: 3.1, APIs: 2, Instructions: 53COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 526 404d11-404d25 call 401e3a 529 404d33-404d38 526->529 530 404d27-404d29 SetLastError 526->530 531 404d2f-404d31 529->531 532 404d3a-404d4d call 404b61 529->532 530->531 533 404d9d-404d9f 531->533 536 404d5b-404d60 532->536 537 404d4f-404d56 532->537 538 404d62 536->538 539 404d67-404d97 CreateWindowExW 536->539 537->536 540 404d58 537->540 538->539 539->533 540->536
                                                                                                                                                                APIs
                                                                                                                                                                • SetLastError.KERNEL32(0000000E,00000000,00000000), ref: 00404D29
                                                                                                                                                                • CreateWindowExW.USER32(?,00000000,?,?,?,?,?,?,?,00000000,?,004102E0), ref: 00404D97
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateErrorLastWindow
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3732789607-0
                                                                                                                                                                • Opcode ID: b8f603c60984adcb040896fc83b973f036cc2853cbe9c367267f13c6c4b58df6
                                                                                                                                                                • Instruction ID: 23e584fcbe498f54003a1ca104303e530149ad01adc9a77cb35aa0601e9a552d
                                                                                                                                                                • Opcode Fuzzy Hash: b8f603c60984adcb040896fc83b973f036cc2853cbe9c367267f13c6c4b58df6
                                                                                                                                                                • Instruction Fuzzy Hash: 8C118671100205AFDB109F55DD09FEB37A8EF88714F01812AFD04A61A0D7B8ECA0DBA4
                                                                                                                                                                Function 00408765 Relevance: 3.0, APIs: 2, Instructions: 30COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 541 408765-408774 542 408776-40877d 541->542 543 40879f-4087a9 call 4084de 541->543 548 40877f call 409d44 542->548 549 40877f call 409d65 542->549 546 4087ae-4087b1 543->546 545 408782-408786 545->543 547 408788-40879d DestroyWindow SetLastError 545->547 547->546 548->545 549->545
                                                                                                                                                                APIs
                                                                                                                                                                • DestroyWindow.USER32(?), ref: 0040878B
                                                                                                                                                                • SetLastError.KERNEL32(00000000), ref: 00408795
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: DestroyErrorLastWindow
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1182162058-0
                                                                                                                                                                • Opcode ID: 13cb1a21998828a0ff01ff8929e8335e4e59032de154602199cd8523b76848e4
                                                                                                                                                                • Instruction ID: c08aace90d9d155b25631d9624727e5b74fa2dd3822c802a65f8e44787599a17
                                                                                                                                                                • Opcode Fuzzy Hash: 13cb1a21998828a0ff01ff8929e8335e4e59032de154602199cd8523b76848e4
                                                                                                                                                                • Instruction Fuzzy Hash: FEF02732100619ABCB025F51DE0489A37A9BF48320B11883AFA95A7190CF78C4619B64
                                                                                                                                                                Function 00403691 Relevance: 1.6, APIs: 1, Instructions: 128COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 550 403691-4036a0 551 4036a6-4036b7 550->551 552 4037c8-4037ca 550->552 553 4036c3-4036d1 551->553 554 4036b9-4036bf 551->554 555 4036d3-4036e3 call 4033b3 553->555 556 4036e9-4036ef 553->556 554->553 555->556 558 4036f1-403704 556->558 559 403712-403717 556->559 572 403708-40370e 558->572 560 403745-40374a 559->560 561 403719-40372f 559->561 563 403755-403760 560->563 564 40374c-403751 560->564 561->560 571 403731-40373d 561->571 567 403762-403767 563->567 568 40376b-403770 563->568 564->563 567->568 569 403772-403777 568->569 570 40377b-403780 568->570 569->570 573 403782-403787 570->573 574 40378b-403790 570->574 571->560 578 40373f-403741 571->578 572->559 573->574 575 403792-403797 574->575 576 40379b-4037a0 574->576 575->576 579 4037a2-4037a7 576->579 580 4037ab-4037bc 576->580 578->560 579->580 581 4037c7 580->581 582 4037be-4037c5 DestroyAcceleratorTable 580->582 581->552 582->581
                                                                                                                                                                APIs
                                                                                                                                                                • DestroyAcceleratorTable.USER32(?), ref: 004037BF
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AcceleratorDestroyTable
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1151768253-0
                                                                                                                                                                • Opcode ID: d5a5ff47f7fca9697c4b34f1172c74ca9dd41a202af6de77666631eaa1e72db9
                                                                                                                                                                • Instruction ID: bd8dcc71be209c1aaf0286c787e1f85acf31303748d64f4bb8fb4ee345a942a6
                                                                                                                                                                • Opcode Fuzzy Hash: d5a5ff47f7fca9697c4b34f1172c74ca9dd41a202af6de77666631eaa1e72db9
                                                                                                                                                                • Instruction Fuzzy Hash: 4741F5B56007049FD720CFA5C8C8E6ABBE9BF49715B64486DE58ADB390CB35ED41CB10
                                                                                                                                                                Function 00409040 Relevance: 1.6, APIs: 1, Instructions: 92COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetDlgItem.USER32(80004005,00000000), ref: 00409087
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Item
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3207170592-0
                                                                                                                                                                • Opcode ID: 3f18e9e906bab45c8685b6b917ccc9b06c72c23cf81ae2c846783f22109e8f32
                                                                                                                                                                • Instruction ID: 13bd88404443163367508c984ae522153f40d1015f77749744c21f74998da7d4
                                                                                                                                                                • Opcode Fuzzy Hash: 3f18e9e906bab45c8685b6b917ccc9b06c72c23cf81ae2c846783f22109e8f32
                                                                                                                                                                • Instruction Fuzzy Hash: 3F31A7B2500205BFEB21DB51C948EABB7FCAF08314F10857EE545A7592D778ED00DB59
                                                                                                                                                                Function 004084DE Relevance: 1.6, APIs: 1, Instructions: 77COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SetWindowLongW.USER32(?,00000000,?), ref: 00408567
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: LongWindow
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1378638983-0
                                                                                                                                                                • Opcode ID: 8d850fe71e01131697ee6bc55998beef8a9505c8079448304663803837ab81e7
                                                                                                                                                                • Instruction ID: ae59f7df9c0a4f2459e8fc5229747c2afea62d83eabb45592b4286403104249f
                                                                                                                                                                • Opcode Fuzzy Hash: 8d850fe71e01131697ee6bc55998beef8a9505c8079448304663803837ab81e7
                                                                                                                                                                • Instruction Fuzzy Hash: 85217C71500709AFCF34CF19DA8499BBBB5EB48350F10492FF986A22A0CA35E950CB96
                                                                                                                                                                Function 00408457 Relevance: 1.5, APIs: 1, Instructions: 33COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?), ref: 00408498
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateWindow
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 716092398-0
                                                                                                                                                                • Opcode ID: 733685e390a2b056ab4fe0e4ab208e25774e1898536d9b84cca54593640f54bd
                                                                                                                                                                • Instruction ID: fb28f1a737edee0979104a613595b2e7c02902fc453f39d16e2c15e148530295
                                                                                                                                                                • Opcode Fuzzy Hash: 733685e390a2b056ab4fe0e4ab208e25774e1898536d9b84cca54593640f54bd
                                                                                                                                                                • Instruction Fuzzy Hash: C5F0B736200209AFDF018F99DD08DAABBAAEF98710B05C16AF94497231D771EC61DB54
                                                                                                                                                                Function 00404DD5 Relevance: 1.5, APIs: 1, Instructions: 16COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • DestroyWindow.USER32(?,?,00404C59), ref: 00404DF1
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: DestroyWindow
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3375834691-0
                                                                                                                                                                • Opcode ID: 51c17b20d3d2a88c36a97f0e2ad943eb09cae2435234225df9c28c5dcf237b31
                                                                                                                                                                • Instruction ID: bc77e311b85b6884efc117d6602258b0553ca57052aa71ea80e5fe2c51deb040
                                                                                                                                                                • Opcode Fuzzy Hash: 51c17b20d3d2a88c36a97f0e2ad943eb09cae2435234225df9c28c5dcf237b31
                                                                                                                                                                • Instruction Fuzzy Hash: 3ED05B715016308FC7305B15D54879773A89F44711B05049DE546E7250C779EC41C694
                                                                                                                                                                Function 00401207 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SysAllocString.OLEAUT32(?), ref: 0040121E
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AllocString
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2525500382-0
                                                                                                                                                                • Opcode ID: b72ae8df51ca284167ad988879b0944e679f12e67a9bac7833b9ca42618ac1db
                                                                                                                                                                • Instruction ID: 9b506291d3be6ffbcef3486986d8e49f406ff68285985f6b62ab30ca92e459f2
                                                                                                                                                                • Opcode Fuzzy Hash: b72ae8df51ca284167ad988879b0944e679f12e67a9bac7833b9ca42618ac1db
                                                                                                                                                                • Instruction Fuzzy Hash: 89D05E31204251EBC7205F64D804747B6E4AB6035AF10487EF188F2160D3788C90CB99
                                                                                                                                                                Function 004025CE Relevance: 1.5, APIs: 1, Instructions: 7COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CallWindowProcW.USER32(?,?,?,?,?), ref: 004025E0
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CallProcWindow
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2714655100-0
                                                                                                                                                                • Opcode ID: 97da41aad94608c33733026655c61b8724f862aab887f979ffb77401b2f7db6f
                                                                                                                                                                • Instruction ID: b3e6de1187edf766203cb830e5bc3f6da9e763212cb2187e0bd32a6ab99e35dc
                                                                                                                                                                • Opcode Fuzzy Hash: 97da41aad94608c33733026655c61b8724f862aab887f979ffb77401b2f7db6f
                                                                                                                                                                • Instruction Fuzzy Hash: BBC0017A418200FFCA025B91DE04D0ABFB2BB99325B15C959B2A95813587338432EB56
                                                                                                                                                                Function 0040AADB Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ___security_init_cookie.LIBCMT ref: 0040AADE
                                                                                                                                                                  • Part of subcall function 0040AA2E: GetCommandLineW.KERNEL32 ref: 0040AA36
                                                                                                                                                                  • Part of subcall function 0040AA2E: ExitProcess.KERNEL32 ref: 0040AA44
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CommandExitLineProcess___security_init_cookie
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3548331429-0
                                                                                                                                                                • Opcode ID: c418a67ab5f6989a22402851831cc5b7807ab5d621d127b4b86a12191cfd9a51
                                                                                                                                                                • Instruction ID: a8543af65a1af56ef700c66af90be35db71b9d5d39d0cb7726e9a32337e903a9
                                                                                                                                                                • Opcode Fuzzy Hash: c418a67ab5f6989a22402851831cc5b7807ab5d621d127b4b86a12191cfd9a51
                                                                                                                                                                • Instruction Fuzzy Hash: 3CA002262A8B4C45945073EB6693559764C4A4061C7C0117FB61D276C31C6D78B096AF
                                                                                                                                                                Function 00401191 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • KiUserCallbackDispatcher.NTDLL(?,00409AD7,00000002), ref: 00401194
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CallbackDispatcherUser
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2492992576-0
                                                                                                                                                                • Opcode ID: b0863944a378dab23152ef8535282dc6a05cb1383cd241958c0948688066d7dc
                                                                                                                                                                • Instruction ID: ea7ed41d7021b4b7818eac619a2553265418cfbb465b58d446217103fc14ecee
                                                                                                                                                                • Opcode Fuzzy Hash: b0863944a378dab23152ef8535282dc6a05cb1383cd241958c0948688066d7dc
                                                                                                                                                                • Instruction Fuzzy Hash: 41A00132004041DBD6093B12EF09404BB39AB8120671589F8D01664031877689A69A49

                                                                                                                                                                Non-executed Functions

                                                                                                                                                                Function 0040A15D Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 70memorylibraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • IsProcessorFeaturePresent.KERNEL32(0000000C,?,0040A22E,00000014,00401E47,00000000,004081CA,00000000,00000000,?,?,004102E0), ref: 0040A160
                                                                                                                                                                • LoadLibraryA.KERNEL32(kernel32.dll,00000014,00000014,?,?,?,004102E0), ref: 0040A17A
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,InterlockedPushEntrySList), ref: 0040A194
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,InterlockedPopEntrySList), ref: 0040A1A1
                                                                                                                                                                • GetProcessHeap.KERNEL32(00000000,00000008,?,?,?,004102E0), ref: 0040A1D3
                                                                                                                                                                • HeapAlloc.KERNEL32(00000000,?,?,?,004102E0), ref: 0040A1D6
                                                                                                                                                                • InterlockedCompareExchange.KERNEL32(?,00000000,00000000), ref: 0040A1EA
                                                                                                                                                                • GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,004102E0), ref: 0040A1F6
                                                                                                                                                                • HeapFree.KERNEL32(00000000,?,?,?,004102E0), ref: 0040A1F9
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Heap$AddressProcProcess$AllocCompareExchangeFeatureFreeInterlockedLibraryLoadPresentProcessor
                                                                                                                                                                • String ID: InterlockedPopEntrySList$InterlockedPushEntrySList$kernel32.dll
                                                                                                                                                                • API String ID: 3830925854-2586642590
                                                                                                                                                                • Opcode ID: ee45b9990f5a85697e6864fa24fdf1cca42a96816a0250fd6d4dd6affa5ac796
                                                                                                                                                                • Instruction ID: e151f3bea11b7a959d498af9b856d7010959e3d6b7f86af2ead3fce87609c1ca
                                                                                                                                                                • Opcode Fuzzy Hash: ee45b9990f5a85697e6864fa24fdf1cca42a96816a0250fd6d4dd6affa5ac796
                                                                                                                                                                • Instruction Fuzzy Hash: 0111B672600318DFD2209FB6AD88E173B6CE745751710887AF509F3351DBB99C61CB69
                                                                                                                                                                Function 0040AB6A Relevance: 7.6, APIs: 5, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • IsDebuggerPresent.KERNEL32 ref: 0040CF0C
                                                                                                                                                                • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040CF21
                                                                                                                                                                • UnhandledExceptionFilter.KERNEL32(0040F0B8), ref: 0040CF2C
                                                                                                                                                                • GetCurrentProcess.KERNEL32(C0000409), ref: 0040CF48
                                                                                                                                                                • TerminateProcess.KERNEL32(00000000), ref: 0040CF4F
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2579439406-0
                                                                                                                                                                • Opcode ID: ef11c1113a78b7b6e9b43d3d3c878c2baeec206f056cfcc71ab5a55a220f9180
                                                                                                                                                                • Instruction ID: 87a5cd26306ba58da4b70f2573c841c26c2d9a1aa672fff7abda688326a58e20
                                                                                                                                                                • Opcode Fuzzy Hash: ef11c1113a78b7b6e9b43d3d3c878c2baeec206f056cfcc71ab5a55a220f9180
                                                                                                                                                                • Instruction Fuzzy Hash: 1F21C3B4500205EFD750DF19E984A983BA5BB08308F10D47AEA19A7261E7F455C48F5E
                                                                                                                                                                Function 0040A06A Relevance: 4.5, APIs: 3, Instructions: 39threadCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetThreadLocale.KERNEL32 ref: 0040A07D
                                                                                                                                                                • GetLocaleInfoA.KERNEL32(00000000,00001004,?,00000007), ref: 0040A08F
                                                                                                                                                                • GetACP.KERNEL32 ref: 0040A0B8
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Locale$InfoThread
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 4232894706-0
                                                                                                                                                                • Opcode ID: 9a90d970f437ffd9edca8fd421fe8ee2f2e7fea9a86389754c87bd7833e80040
                                                                                                                                                                • Instruction ID: c56cb4481b97ef4eaa8f63431da3792916c0003af48a97e6627cedc285dce081
                                                                                                                                                                • Opcode Fuzzy Hash: 9a90d970f437ffd9edca8fd421fe8ee2f2e7fea9a86389754c87bd7833e80040
                                                                                                                                                                • Instruction Fuzzy Hash: 38F0AF31E0032CABDB159F6599156AFB7E4AB04B40B4441BEED41B7280DA786E18879A
                                                                                                                                                                Function 00401590 Relevance: 27.2, APIs: 18, Instructions: 196comCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetWindowLongW.USER32(?,000000EC), ref: 004015D1
                                                                                                                                                                • GetWindowLongW.USER32(?,000000EC), ref: 004015E5
                                                                                                                                                                • SetWindowLongW.USER32(?,000000EC,00000000), ref: 004015EF
                                                                                                                                                                • GetWindowLongW.USER32(?,000000EB), ref: 004015FF
                                                                                                                                                                • OleUninitialize.OLE32 ref: 0040160F
                                                                                                                                                                • OleInitialize.OLE32(00000000), ref: 0040161D
                                                                                                                                                                • GetWindowTextLengthW.USER32(?), ref: 00401626
                                                                                                                                                                • __alloca_probe_16.LIBCMT ref: 00401639
                                                                                                                                                                • __freea.LIBCMT ref: 00401668
                                                                                                                                                                • DefWindowProcW.USER32(?,?,?,?), ref: 00401798
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Window$Long$InitializeLengthProcTextUninitialize__alloca_probe_16__freea
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 28949450-0
                                                                                                                                                                • Opcode ID: c214d2b51a8ed9ae9d48573adc36a31d1fb4d11f9ed61c948cbe6f55d6a84caf
                                                                                                                                                                • Instruction ID: effee5ad4f1be7dec0c043332801250c12b4d133a061a5caa54761ffb30a4dca
                                                                                                                                                                • Opcode Fuzzy Hash: c214d2b51a8ed9ae9d48573adc36a31d1fb4d11f9ed61c948cbe6f55d6a84caf
                                                                                                                                                                • Instruction Fuzzy Hash: 9D618931900109AFDF10AFA5CC88DAE7BB9EF45314B14497AF906BB2B0CB399D51CB59
                                                                                                                                                                Function 00402CAB Relevance: 25.6, APIs: 17, Instructions: 134windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • BeginPaint.USER32(?,?), ref: 00402CD1
                                                                                                                                                                • GetClientRect.USER32(?,?), ref: 00402CE9
                                                                                                                                                                • CreateSolidBrush.GDI32(?), ref: 00402CF5
                                                                                                                                                                • FillRect.USER32(?,?,00000000), ref: 00402D09
                                                                                                                                                                • DeleteObject.GDI32(?), ref: 00402D10
                                                                                                                                                                • EndPaint.USER32(?,?), ref: 00402D1D
                                                                                                                                                                • BeginPaint.USER32(?,?), ref: 00402D3F
                                                                                                                                                                • GetClientRect.USER32(?,?), ref: 00402D59
                                                                                                                                                                • CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00402D6E
                                                                                                                                                                • CreateCompatibleDC.GDI32(00000000), ref: 00402D7C
                                                                                                                                                                • SelectObject.GDI32(00000000,?), ref: 00402D8C
                                                                                                                                                                • CreateSolidBrush.GDI32(?), ref: 00402D9F
                                                                                                                                                                • FillRect.USER32(00000000,?,00000000), ref: 00402DB2
                                                                                                                                                                • DeleteObject.GDI32(?), ref: 00402DBB
                                                                                                                                                                • BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 00402DEF
                                                                                                                                                                • SelectObject.GDI32(00000000,?), ref: 00402DF9
                                                                                                                                                                • DeleteDC.GDI32(00000000), ref: 00402E00
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateObjectRect$DeletePaint$BeginBrushClientCompatibleFillSelectSolid$Bitmap
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2927874120-0
                                                                                                                                                                • Opcode ID: f5351232a72c2a7bd7d01dfa25e42ebdf65d37a6d1c47cd332916ba376a21b18
                                                                                                                                                                • Instruction ID: 36815eef4fe8322802c040f1513f16118a053fc1b4710b6c06e06feeafe233fa
                                                                                                                                                                • Opcode Fuzzy Hash: f5351232a72c2a7bd7d01dfa25e42ebdf65d37a6d1c47cd332916ba376a21b18
                                                                                                                                                                • Instruction Fuzzy Hash: 9241F971900208AFDB119FE5DE88DAFBBBDFF48300B144929F516F61A1D7B49851DB24
                                                                                                                                                                Function 0040194E Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 111registrywindowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • EnterCriticalSection.KERNEL32(004102E4,75BFA7D0,0041025C,?,?,?,?,?,?,?,00409B2E,00000000,?,00000000,?,0040AACE), ref: 00401960
                                                                                                                                                                • RegisterWindowMessageW.USER32(WM_ATLGETHOST,?,?,?,?,?,?,?,00409B2E,00000000,?,00000000,?,0040AACE,00000000), ref: 00401975
                                                                                                                                                                • RegisterWindowMessageW.USER32(WM_ATLGETCONTROL,?,?,?,?,?,?,?,00409B2E,00000000,?,00000000,?,0040AACE,00000000), ref: 00401981
                                                                                                                                                                • GetClassInfoExW.USER32(AtlAxWin80,?), ref: 0040199E
                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F00), ref: 004019D2
                                                                                                                                                                • RegisterClassExW.USER32(?), ref: 004019EF
                                                                                                                                                                • _memset.LIBCMT ref: 00401A18
                                                                                                                                                                • GetClassInfoExW.USER32(AtlAxWinLic80,?), ref: 00401A33
                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F00), ref: 00401A68
                                                                                                                                                                • RegisterClassExW.USER32(?), ref: 00401A85
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ClassRegister$CursorInfoLoadMessageWindow$CriticalEnterSection_memset
                                                                                                                                                                • String ID: AtlAxWin80$AtlAxWinLic80$WM_ATLGETCONTROL$WM_ATLGETHOST
                                                                                                                                                                • API String ID: 261302686-3337273722
                                                                                                                                                                • Opcode ID: 4a55bb04a6b1ac8b22b89fffd7d0d06a69fbce849206a73cff786c4287874eec
                                                                                                                                                                • Instruction ID: 3910b29c3a457e283f4a3f7959ffc8bfe486fa82896336a0283b9c96a4e89cf3
                                                                                                                                                                • Opcode Fuzzy Hash: 4a55bb04a6b1ac8b22b89fffd7d0d06a69fbce849206a73cff786c4287874eec
                                                                                                                                                                • Instruction Fuzzy Hash: 9241E9B1D01218ABCB00DF96E9849DEBBF8AB48300F10846BE515B3261DBB85A408F59
                                                                                                                                                                Function 00407BBF Relevance: 21.4, APIs: 8, Strings: 4, Instructions: 388stringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • lstrcmpiW.KERNEL32(?,Delete,00000000,?,00000000), ref: 00407C14
                                                                                                                                                                • lstrcmpiW.KERNEL32(?,ForceRemove,?,00000000), ref: 00407C23
                                                                                                                                                                • lstrlenW.KERNEL32(?,?,?,?,?,00000000), ref: 00407FE5
                                                                                                                                                                  • Part of subcall function 00406CD1: RegCloseKey.ADVAPI32(?,?,00406D2C), ref: 00406CDD
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: lstrcmpi$Closelstrlen
                                                                                                                                                                • String ID: Delete$ForceRemove$NoRemove$Val
                                                                                                                                                                • API String ID: 4232074402-1781481701
                                                                                                                                                                • Opcode ID: 0e712fd60833333e102971358f32d38840b1b2241964b633817ce5c99cc2e804
                                                                                                                                                                • Instruction ID: 3bacee492ebb2aaf426e26210893bfd845cbe203986d295bb222b9db971dc9d7
                                                                                                                                                                • Opcode Fuzzy Hash: 0e712fd60833333e102971358f32d38840b1b2241964b633817ce5c99cc2e804
                                                                                                                                                                • Instruction Fuzzy Hash: 92D17E31D042199BDF31ABA1C991AAE7778AF04708F11013FE952B72C2DF389D44DB5A
                                                                                                                                                                Function 00402E52 Relevance: 16.6, APIs: 11, Instructions: 119COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetStockObject.GDI32(00000011), ref: 00402EA7
                                                                                                                                                                • GetStockObject.GDI32(0000000D), ref: 00402EAF
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ObjectStock
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3428563643-0
                                                                                                                                                                • Opcode ID: 81769b32cfa16ad1d40fdcc7ffccace314bdacb8d0b8abe9e404e29740791a5d
                                                                                                                                                                • Instruction ID: f90d8bbc10aba9188a552fe6a97696365134d4a0cb20ad61b26ad1f36b370a65
                                                                                                                                                                • Opcode Fuzzy Hash: 81769b32cfa16ad1d40fdcc7ffccace314bdacb8d0b8abe9e404e29740791a5d
                                                                                                                                                                • Instruction Fuzzy Hash: EE414C75900219AFCB10EFB5CD88AEEBBB4AB18344F10483AF915E72D0D6789954CF54
                                                                                                                                                                Function 004022F5 Relevance: 13.6, APIs: 9, Instructions: 74COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: a88da030a0f23098a5d4d4b74867a3f8e927922dbc7ab80e820a73d821cf1a8d
                                                                                                                                                                • Instruction ID: 864c6fe6c14e4c5da41d81da67b2d2acdb50291213bf12b31d41ed4477e8b06e
                                                                                                                                                                • Opcode Fuzzy Hash: a88da030a0f23098a5d4d4b74867a3f8e927922dbc7ab80e820a73d821cf1a8d
                                                                                                                                                                • Instruction Fuzzy Hash: 1D212C71504216AFEB119F79DE4CB6B7BA8BF04304F040839ED41F22A1D7B998609B59
                                                                                                                                                                Function 00407928 Relevance: 10.7, APIs: 7, Instructions: 221stringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00406EF7: lstrcmpiW.KERNEL32(?,?,00407991,?,?,?,00000000,00000001,?,00407E4F,?,00000000,?,?,00000000), ref: 00406F61
                                                                                                                                                                • lstrlenW.KERNEL32(?,?,00000000,00000001,?,00407E4F,?,00000000,?,?,00000000), ref: 004079F0
                                                                                                                                                                • CharNextW.USER32(?,00000002,?,00000000), ref: 00407A22
                                                                                                                                                                • CharNextW.USER32(00000000,?,00000000), ref: 00407A3A
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CharNext$lstrcmpilstrlen
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1051761657-0
                                                                                                                                                                • Opcode ID: 6d83cb8ce642e0a97dcec1801c7e6a4081e9bb5d1499e946e86fbd57e3611fa4
                                                                                                                                                                • Instruction ID: 9beb27c25970e011abd7f4747c08830813502d25a1228566d0cad314f2fe5feb
                                                                                                                                                                • Opcode Fuzzy Hash: 6d83cb8ce642e0a97dcec1801c7e6a4081e9bb5d1499e946e86fbd57e3611fa4
                                                                                                                                                                • Instruction Fuzzy Hash: DB718171D042089ADB21DFB5CC849EE77B9EF44314F20453FE919B7282DB386945CB56
                                                                                                                                                                Function 0040965F Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 137stringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00401CE1: InitializeCriticalSection.KERNEL32(?,0040F120,0000000C,00402929,00000000,00404EE2,00000000,?,80004003,004059C0,?), ref: 00401CF2
                                                                                                                                                                • GetModuleFileNameW.KERNEL32(00400000,?,00000104), ref: 00409717
                                                                                                                                                                • GetModuleHandleW.KERNEL32(00000000), ref: 00409769
                                                                                                                                                                  • Part of subcall function 00401CA1: lstrlenW.KERNEL32(?,00403B86,00000000,?,?), ref: 00401CA5
                                                                                                                                                                • lstrlenW.KERNEL32(?), ref: 004097B6
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Modulelstrlen$CriticalFileHandleInitializeNameSection
                                                                                                                                                                • String ID: Module$Module_Raw$REGISTRY
                                                                                                                                                                • API String ID: 3852420207-549000027
                                                                                                                                                                • Opcode ID: c7c86fee8a8619c7807ac6ec62dc070ca58d10c94a310cf1112faadda730bc82
                                                                                                                                                                • Instruction ID: 3ad320125d83b5cd87979e75fc329e0cd712c19b8e70a303ea255d6198c75312
                                                                                                                                                                • Opcode Fuzzy Hash: c7c86fee8a8619c7807ac6ec62dc070ca58d10c94a310cf1112faadda730bc82
                                                                                                                                                                • Instruction Fuzzy Hash: C8519F729101599BDB21DFA5CC85AEE73B8AF04308F14043BE905F72C2EB79AE14CB59
                                                                                                                                                                Function 0040983C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 135stringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00401CE1: InitializeCriticalSection.KERNEL32(?,0040F120,0000000C,00402929,00000000,00404EE2,00000000,?,80004003,004059C0,?), ref: 00401CF2
                                                                                                                                                                • GetModuleFileNameW.KERNEL32(00400000,?,00000104), ref: 004098EB
                                                                                                                                                                • GetModuleHandleW.KERNEL32(00000000), ref: 0040993D
                                                                                                                                                                  • Part of subcall function 00401CA1: lstrlenW.KERNEL32(?,00403B86,00000000,?,?), ref: 00401CA5
                                                                                                                                                                • lstrlenW.KERNEL32(?), ref: 0040998A
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Modulelstrlen$CriticalFileHandleInitializeNameSection
                                                                                                                                                                • String ID: Module$Module_Raw$REGISTRY
                                                                                                                                                                • API String ID: 3852420207-549000027
                                                                                                                                                                • Opcode ID: bc8832b8a168cca473093e71fd0683c7253bb3db02b362cc6ee309ac0f585717
                                                                                                                                                                • Instruction ID: a8535f27d6d7a3f8082f4af9bd06015fe4922fcf4a491c5011b3b0c3df28e119
                                                                                                                                                                • Opcode Fuzzy Hash: bc8832b8a168cca473093e71fd0683c7253bb3db02b362cc6ee309ac0f585717
                                                                                                                                                                • Instruction Fuzzy Hash: F04184729101589BEB25EBD5CC45AEE73B8AF44308F14443BE905F72C2EB78AE088759
                                                                                                                                                                Function 00405A4A Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 123COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • EnterCriticalSection.KERNEL32(?), ref: 00405A80
                                                                                                                                                                • GetClassInfoExW.USER32(00000000,?,?), ref: 00405ABA
                                                                                                                                                                • GetClassInfoExW.USER32(?,?,00000030), ref: 00405ACC
                                                                                                                                                                  • Part of subcall function 0040145C: LeaveCriticalSection.KERNEL32(00000000,00000030,00401AB8,?,?,?,?,?,?,?,?,?,00409B2E,00000000,?,00000000), ref: 00401467
                                                                                                                                                                • LoadCursorW.USER32(?,?), ref: 00405B13
                                                                                                                                                                • GetClassInfoExW.USER32(?,00000000,?), ref: 00405B57
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ClassInfo$CriticalSection$CursorEnterLeaveLoad
                                                                                                                                                                • String ID: 0
                                                                                                                                                                • API String ID: 158815643-4108050209
                                                                                                                                                                • Opcode ID: e769982c72fffa5cd844ce94e0a41c06f560553b37814d92871cf4a4059ee128
                                                                                                                                                                • Instruction ID: b1f1f4aea7105cec710bb840670b560e23e93aac3c5c739135e3a17ca0da8162
                                                                                                                                                                • Opcode Fuzzy Hash: e769982c72fffa5cd844ce94e0a41c06f560553b37814d92871cf4a4059ee128
                                                                                                                                                                • Instruction Fuzzy Hash: 56412875A01614DBCF15DFA4C8C09ABBBB8FF48710B1045AAED05AB285E374ED41CFA8
                                                                                                                                                                Function 0040759B Relevance: 9.1, APIs: 6, Instructions: 118stringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • lstrlenW.KERNEL32(?), ref: 004075CD
                                                                                                                                                                • CoTaskMemFree.OLE32(00000000,00000000), ref: 004075E6
                                                                                                                                                                • CharNextW.USER32(00000000,00000000), ref: 00407613
                                                                                                                                                                • CharNextW.USER32(?,?), ref: 00407673
                                                                                                                                                                • CharNextW.USER32(?,00000000,00000001,00000000), ref: 0040768E
                                                                                                                                                                • CoTaskMemFree.OLE32(?,00000000), ref: 004076AC
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CharNext$FreeTask$lstrlen
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3737899670-0
                                                                                                                                                                • Opcode ID: 3f6df31c5f4c8e40d39cf0dc270568bd26dca20aa80279ebd8d202b51859222a
                                                                                                                                                                • Instruction ID: 70815ff03149cf6553a566cfaa54808779a48834d549263be91617a47d87fdff
                                                                                                                                                                • Opcode Fuzzy Hash: 3f6df31c5f4c8e40d39cf0dc270568bd26dca20aa80279ebd8d202b51859222a
                                                                                                                                                                • Instruction Fuzzy Hash: CF418271D14605DBDB249F69CC84A6EBBB4EF44314F20483FE842B7290DB7AA851CB5E
                                                                                                                                                                Function 0040940C Relevance: 9.1, APIs: 6, Instructions: 105libraryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • LoadLibraryExW.KERNEL32(?,00000000,00000002), ref: 0040945C
                                                                                                                                                                • FindResourceW.KERNEL32(00000000,?,?), ref: 0040947E
                                                                                                                                                                • FreeLibrary.KERNEL32(?), ref: 0040953D
                                                                                                                                                                  • Part of subcall function 00401D2C: GetLastError.KERNEL32(0040948F), ref: 00401D2C
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Library$ErrorFindFreeLastLoadResource
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3418355812-0
                                                                                                                                                                • Opcode ID: 1146f57231f934f551236d10b7fd17082be6310c57974bbe22b2d2ae4ba9fe98
                                                                                                                                                                • Instruction ID: 24ffe316f32aa359846eea3b4a83ecbad62831f282a55d7e675dc3e0195270ff
                                                                                                                                                                • Opcode Fuzzy Hash: 1146f57231f934f551236d10b7fd17082be6310c57974bbe22b2d2ae4ba9fe98
                                                                                                                                                                • Instruction Fuzzy Hash: 89419A71D00218AFCB219FA6DC849DEBBB9AF04304F50453AE40ABB2A2DB785D41CF59
                                                                                                                                                                Function 00403C54 Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SysFreeString.OLEAUT32(?), ref: 00403CAF
                                                                                                                                                                • SysStringLen.OLEAUT32(?), ref: 00403CC0
                                                                                                                                                                • SysStringLen.OLEAUT32(?), ref: 00403CC9
                                                                                                                                                                • CoTaskMemAlloc.OLE32(00000002), ref: 00403CD0
                                                                                                                                                                • SysFreeString.OLEAUT32(?), ref: 00403CDF
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: String$Free$AllocTask
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2715170445-0
                                                                                                                                                                • Opcode ID: 0c651ead3906f53c06f01d0419752ca8fbbd77829224e7cc053804149b8939e0
                                                                                                                                                                • Instruction ID: 2aef50a02de2c0aeac59006375392b77dce537653f92314ff73230b84a04e9a3
                                                                                                                                                                • Opcode Fuzzy Hash: 0c651ead3906f53c06f01d0419752ca8fbbd77829224e7cc053804149b8939e0
                                                                                                                                                                • Instruction Fuzzy Hash: 42214972500219EFEF11DF55DE44A9A7BB8EF04716F10402AF805B72A0D779DE20EBA5
                                                                                                                                                                Function 004024BF Relevance: 9.0, APIs: 6, Instructions: 46COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetDC.USER32(00000000), ref: 004024E9
                                                                                                                                                                • GetDeviceCaps.GDI32(00000000,00000058), ref: 004024FA
                                                                                                                                                                • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00402503
                                                                                                                                                                • ReleaseDC.USER32(00000000,00000000), ref: 0040250C
                                                                                                                                                                • MulDiv.KERNEL32(?,?,000009EC), ref: 00402524
                                                                                                                                                                • MulDiv.KERNEL32(?,00000000,000009EC), ref: 00402530
                                                                                                                                                                  • Part of subcall function 00401029: RaiseException.KERNEL32(-C0000018,00000001,00000000,00000000,004017DC,80004005,00000000,00000030,AtlAxWinLic80,00401AA4), ref: 00401046
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CapsDevice$ExceptionRaiseRelease
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 603618608-0
                                                                                                                                                                • Opcode ID: 96d470b54afcc190c8ea002b7b74a5c88e16c0b6d3e2b0effbe5733829919dca
                                                                                                                                                                • Instruction ID: ca09f7603537b562a55d1fe78f2598cecccdad8f9f28e48307fa7d1c997bad25
                                                                                                                                                                • Opcode Fuzzy Hash: 96d470b54afcc190c8ea002b7b74a5c88e16c0b6d3e2b0effbe5733829919dca
                                                                                                                                                                • Instruction Fuzzy Hash: 36018F71104304AFE711AF62DD44A1BBBA8FF58758F00492AFA84772A1D6759C208A69
                                                                                                                                                                Function 0040253C Relevance: 9.0, APIs: 6, Instructions: 46COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetDC.USER32(00000000), ref: 00402566
                                                                                                                                                                • GetDeviceCaps.GDI32(00000000,00000058), ref: 00402577
                                                                                                                                                                • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00402580
                                                                                                                                                                • ReleaseDC.USER32(00000000,00000000), ref: 00402589
                                                                                                                                                                • MulDiv.KERNEL32(000009EC,?,?), ref: 004025A1
                                                                                                                                                                • MulDiv.KERNEL32(000009EC,00000000,?), ref: 004025AD
                                                                                                                                                                  • Part of subcall function 00401029: RaiseException.KERNEL32(-C0000018,00000001,00000000,00000000,004017DC,80004005,00000000,00000030,AtlAxWinLic80,00401AA4), ref: 00401046
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CapsDevice$ExceptionRaiseRelease
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 603618608-0
                                                                                                                                                                • Opcode ID: 9d3578e258c01fd88bbb19e7fe0cfc559ccb5674c05cabce7050c81d0de611f4
                                                                                                                                                                • Instruction ID: 241983a4a3e18299e212648792d6085d737ea81bed2319af26d05c91bcdad83e
                                                                                                                                                                • Opcode Fuzzy Hash: 9d3578e258c01fd88bbb19e7fe0cfc559ccb5674c05cabce7050c81d0de611f4
                                                                                                                                                                • Instruction Fuzzy Hash: 4C018F75104315AFE311AF62DD44B1BBBA8FB58755F004829FA84B7291C67598108B69
                                                                                                                                                                Function 00407054 Relevance: 7.6, APIs: 5, Instructions: 106COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CharNext
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3213498283-0
                                                                                                                                                                • Opcode ID: 7c8c5e24260911d3063e4083af7a4170b6a32ae4faadd7bfe46feb890225e6c4
                                                                                                                                                                • Instruction ID: b3786078afadd5237d368cd7641b66036d738919889183352dbc9798068466b7
                                                                                                                                                                • Opcode Fuzzy Hash: 7c8c5e24260911d3063e4083af7a4170b6a32ae4faadd7bfe46feb890225e6c4
                                                                                                                                                                • Instruction Fuzzy Hash: 0E31A570908206DADB249F28C88062673E5FF65344B20453AE4C2EB3D1E778AD91C75A
                                                                                                                                                                Function 00408EC0 Relevance: 7.6, APIs: 5, Instructions: 105windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • FindResourceW.KERNEL32(00400000,?,000000F0), ref: 00408EF7
                                                                                                                                                                • LoadResource.KERNEL32(00400000,00000000), ref: 00408F07
                                                                                                                                                                • LockResource.KERNEL32(00000000), ref: 00408F16
                                                                                                                                                                • SendDlgItemMessageW.USER32(?,00000000,00000143,00000000,?), ref: 00408F7B
                                                                                                                                                                • SendDlgItemMessageW.USER32(?,00000001,0000040B,00000000,00000001), ref: 00409005
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Resource$ItemMessageSend$FindLoadLock
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 915806882-0
                                                                                                                                                                • Opcode ID: 4dcce77468c73a46aebe3cdc54ccb56f5a0e837ac25150b356bad12689ec9026
                                                                                                                                                                • Instruction ID: 8ca510456220d8c0525df8bd257bd57df76f3223a6d027143b0dab0b192fe0ba
                                                                                                                                                                • Opcode Fuzzy Hash: 4dcce77468c73a46aebe3cdc54ccb56f5a0e837ac25150b356bad12689ec9026
                                                                                                                                                                • Instruction Fuzzy Hash: C8417F719001289FEB309F25DD41FA9B3B5AF04311F1041AAE95DB22D2DB789E85CF68
                                                                                                                                                                Function 0040A559 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • _memset.LIBCMT ref: 0040A574
                                                                                                                                                                • GetVersionExA.KERNEL32(00410340,0040AA4F), ref: 0040A583
                                                                                                                                                                • InitializeCriticalSection.KERNEL32(004103D4), ref: 0040A599
                                                                                                                                                                • EnterCriticalSection.KERNEL32(004103D4), ref: 0040A5A0
                                                                                                                                                                • GetProcessHeap.KERNEL32 ref: 0040A5A9
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CriticalSection$EnterHeapInitializeProcessVersion_memset
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 621449112-0
                                                                                                                                                                • Opcode ID: 35415e3c5d343d80d4841c4419515c00e585d102efdaf0729b73992fc5d9f18e
                                                                                                                                                                • Instruction ID: 3f26f715435f419315713ca405886c77d5859c7c5d5830aba2f352384caadbee
                                                                                                                                                                • Opcode Fuzzy Hash: 35415e3c5d343d80d4841c4419515c00e585d102efdaf0729b73992fc5d9f18e
                                                                                                                                                                • Instruction Fuzzy Hash: 92018C71A00305EBC710AFA3DE4445D7BA5BB85315718893BE629B62C1C77C89B28F5F
                                                                                                                                                                Function 00401DC4 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CharNextW.USER32(\5@,?,?,0040355C,?,0040E6B4), ref: 00401DEE
                                                                                                                                                                • CharNextW.USER32(?,?,?,0040355C,?,0040E6B4), ref: 00401DF5
                                                                                                                                                                • CharNextW.USER32(?,?,?,0040355C,?,0040E6B4), ref: 00401E03
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CharNext
                                                                                                                                                                • String ID: \5@
                                                                                                                                                                • API String ID: 3213498283-1309314528
                                                                                                                                                                • Opcode ID: 6be95cc0f8c55a9b8c49f6dc619d3a8a18184969920bf0195be3778cc2df7b9e
                                                                                                                                                                • Instruction ID: 8726cf236ae77b94a83517557ca1126e442273100c8a4f8a9822b0c1dc0d8325
                                                                                                                                                                • Opcode Fuzzy Hash: 6be95cc0f8c55a9b8c49f6dc619d3a8a18184969920bf0195be3778cc2df7b9e
                                                                                                                                                                • Instruction Fuzzy Hash: 1CE0653550421287C7115B29D80057B67B7EFC07A1725443FF450B33E0E7B8AD41A699
                                                                                                                                                                Function 00401F0E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28stringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetParent.USER32 ref: 00401F22
                                                                                                                                                                • GetClassNameW.USER32(00000000,?,00000008), ref: 00401F2F
                                                                                                                                                                • lstrcmpW.KERNEL32(?,#32770), ref: 00401F42
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ClassNameParentlstrcmp
                                                                                                                                                                • String ID: #32770
                                                                                                                                                                • API String ID: 3513268407-463685578
                                                                                                                                                                • Opcode ID: ee7cc9481c5b521f00df008888194c2f70e88a60c9780ad852d78c0b775b634e
                                                                                                                                                                • Instruction ID: 7db31976ef58849cc2c61346ea34b91c715d8929c97d64d2787645f897e7581a
                                                                                                                                                                • Opcode Fuzzy Hash: ee7cc9481c5b521f00df008888194c2f70e88a60c9780ad852d78c0b775b634e
                                                                                                                                                                • Instruction Fuzzy Hash: 26E03030A10208AFDF04EBB5CD1AE6A77B8AB08704B500979B502F71D0EA78A9149719
                                                                                                                                                                Function 0040A72D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleHandleA.KERNEL32(Kernel32.dll,0040D2F5,?,0040ADC6,00000000,00000000,00000000,00000000,00000000,?,?,?,?,0040AEBE,?,?), ref: 0040A732
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 0040A742
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressHandleModuleProc
                                                                                                                                                                • String ID: DecodePointer$Kernel32.dll
                                                                                                                                                                • API String ID: 1646373207-3470280412
                                                                                                                                                                • Opcode ID: 143423ea5c32141395bb756c3cafa9d0fd3dd0f75abda0f6482ef2f37c9da173
                                                                                                                                                                • Instruction ID: b5788b40b0853c6dc7a37ca7fa3ef79ec24840802908159530c9da3f035f8337
                                                                                                                                                                • Opcode Fuzzy Hash: 143423ea5c32141395bb756c3cafa9d0fd3dd0f75abda0f6482ef2f37c9da173
                                                                                                                                                                • Instruction Fuzzy Hash: 55D09E70644300AADA209F768E4970A76E46E80B41B54C8397549F3690D6B8C814D72A
                                                                                                                                                                Function 004086B4 Relevance: 6.3, APIs: 5, Instructions: 76stringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • lstrlenA.KERNEL32(?), ref: 004086CF
                                                                                                                                                                • MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,?,00000001), ref: 004086FF
                                                                                                                                                                • GetLastError.KERNEL32(?,00000001), ref: 0040870A
                                                                                                                                                                • MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,?,00000001), ref: 00408723
                                                                                                                                                                • MultiByteToWideChar.KERNEL32(?,00000000,?,?,?,?,?,?,?,00000001), ref: 0040874C
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ByteCharMultiWide$ErrorLastlstrlen
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3322701435-0
                                                                                                                                                                • Opcode ID: 4a5b6fa4ec8c6909c6af7ae41f2e30f19464fd209faff48647098981153f76bb
                                                                                                                                                                • Instruction ID: 48908fbd435a580ce89bed673ba8d31bff0f2ee05809f4ea8a84d6cc99bb99c2
                                                                                                                                                                • Opcode Fuzzy Hash: 4a5b6fa4ec8c6909c6af7ae41f2e30f19464fd209faff48647098981153f76bb
                                                                                                                                                                • Instruction Fuzzy Hash: 8911B432801124FBDF212F92CD44D9FBF6DEF457A0B108576FD48AA160DA768A20DBE5
                                                                                                                                                                Function 00401235 Relevance: 6.1, APIs: 4, Instructions: 132COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: String$Free
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1391021980-0
                                                                                                                                                                • Opcode ID: de62730f88848f88c4bbaa6e7e82ed849049633fee533dd479b039f000a9baa6
                                                                                                                                                                • Instruction ID: cb77998e7024dae3b669df9451ed5b3ebcb51d72841bf7db81120ee9a12ce087
                                                                                                                                                                • Opcode Fuzzy Hash: de62730f88848f88c4bbaa6e7e82ed849049633fee533dd479b039f000a9baa6
                                                                                                                                                                • Instruction Fuzzy Hash: 1D415F71A002099FEB25DFA5CC49EAEB3B8BF04704F14412EF915EB291E774AA05CF59
                                                                                                                                                                Function 00405D55 Relevance: 6.1, APIs: 4, Instructions: 102COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetClientRect.USER32(?,?), ref: 00405E08
                                                                                                                                                                • GetClientRect.USER32(?,?), ref: 00405E10
                                                                                                                                                                • CreateAcceleratorTableW.USER32(?,00000001), ref: 00405E2B
                                                                                                                                                                • GetParent.USER32(?), ref: 00405E4F
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ClientRect$AcceleratorCreateParentTable
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2716292469-0
                                                                                                                                                                • Opcode ID: 3cb7a709e67cb0e5bb1a88611679f3adb8faac63631730c3f9f0bcc12b9d51fb
                                                                                                                                                                • Instruction ID: 6c8c7b589815834652913391f2eafc525150b4cf2c6eb88aef6f49848b1dc11d
                                                                                                                                                                • Opcode Fuzzy Hash: 3cb7a709e67cb0e5bb1a88611679f3adb8faac63631730c3f9f0bcc12b9d51fb
                                                                                                                                                                • Instruction Fuzzy Hash: 8131197250060AEFCF11DFA5C88499BBBB5FF55304B10883EE949EB290D734AA95CF94
                                                                                                                                                                Function 004037CB Relevance: 6.1, APIs: 4, Instructions: 65windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Focus$ChildWindow
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 501040988-0
                                                                                                                                                                • Opcode ID: fd406a10ea4aea3a7a5bb3e5849efb86bc6955d798d6ae10cb0e4b5896c3f78e
                                                                                                                                                                • Instruction ID: 532c01201f7fede4d2c78af55f4bbdb3a0723938ccf6e1461939e7ddf0d1230e
                                                                                                                                                                • Opcode Fuzzy Hash: fd406a10ea4aea3a7a5bb3e5849efb86bc6955d798d6ae10cb0e4b5896c3f78e
                                                                                                                                                                • Instruction Fuzzy Hash: CA218E72500700EFCB20AF65C948E5BBBF9FF85B05B1088A9F856A73A0D735AE01DB14
                                                                                                                                                                Function 00406972 Relevance: 6.1, APIs: 4, Instructions: 64windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0040698C
                                                                                                                                                                • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 004069B3
                                                                                                                                                                • TranslateMessage.USER32(?), ref: 004069CE
                                                                                                                                                                • DispatchMessageW.USER32(?), ref: 004069D5
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Message$DispatchPeekTranslate
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 4217535847-0
                                                                                                                                                                • Opcode ID: 7eb9c73f79bfd4e62718ef7173afa342773132f2190057e34eb45e82fdde83c8
                                                                                                                                                                • Instruction ID: 8551429d61bd0d2422191465250ca64f7c2bbda6e96765fba344c858e9ac1b5b
                                                                                                                                                                • Opcode Fuzzy Hash: 7eb9c73f79bfd4e62718ef7173afa342773132f2190057e34eb45e82fdde83c8
                                                                                                                                                                • Instruction Fuzzy Hash: 2D01C8F12055196FD7105F528C8897B779CEF41359712053BF513E2580DB38CC2256EA
                                                                                                                                                                Function 0040A848 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 47COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • EnterCriticalSection.KERNEL32(004103D4,0040F160,0000000C,0040AAD5,00000000), ref: 0040A85A
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CriticalEnterSection
                                                                                                                                                                • String ID: @$@$@
                                                                                                                                                                • API String ID: 1904992153-3781450513
                                                                                                                                                                • Opcode ID: 9d9ce20bab2c3ae863576952f7f92721fdb434e0a139a960a5c283693cb95302
                                                                                                                                                                • Instruction ID: 0b707a8e5d76eb43a9908df19c84302258d993c8af28573cab87c81897dd866a
                                                                                                                                                                • Opcode Fuzzy Hash: 9d9ce20bab2c3ae863576952f7f92721fdb434e0a139a960a5c283693cb95302
                                                                                                                                                                • Instruction Fuzzy Hash: 31112A72C00725CBC7247FAA9904459F7A0BB50310729CA7BE8A5372D4CB7D08A29B9F
                                                                                                                                                                Function 004023C6 Relevance: 6.0, APIs: 4, Instructions: 38windowCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetClientRect.USER32(?,?), ref: 004023E1
                                                                                                                                                                • BitBlt.GDI32(00000000,?,?,?,?,?,00000000,00000000,00CC0020), ref: 0040240A
                                                                                                                                                                • DeleteDC.GDI32(?), ref: 00402413
                                                                                                                                                                • ReleaseDC.USER32(?,?), ref: 00402425
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.2228699560.0000000000401000.00000020.00000001.01000000.00000013.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.2228659623.0000000000400000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228722423.000000000040E000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228753175.0000000000410000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.2228787646.0000000000411000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_BitComet_stats.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ClientDeleteRectRelease
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2015589292-0
                                                                                                                                                                • Opcode ID: 614cfa66847d2ce2c7a67bbf7b93c0e3b4ce5d3dd69e48e1ba636696985369e4
                                                                                                                                                                • Instruction ID: 9eb2079b5f884d9a32cc1e93a0881bdc95c6dfe1e025d8a8f6cda5fe4ba1e541
                                                                                                                                                                • Opcode Fuzzy Hash: 614cfa66847d2ce2c7a67bbf7b93c0e3b4ce5d3dd69e48e1ba636696985369e4
                                                                                                                                                                • Instruction Fuzzy Hash: 8F01E836500118FFEB11DFA9DE48FAEBBB9FB08300F008964F955B62A0C771A920DB54

                                                                                                                                                                Execution Graph

                                                                                                                                                                Execution Coverage:7.1%
                                                                                                                                                                Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                Signature Coverage:3.2%
                                                                                                                                                                Total number of Nodes:2000
                                                                                                                                                                Total number of Limit Nodes:46
                                                                                                                                                                execution_graph 83500 6b732a 83505 6b70bf 83500->83505 83502 6b7340 83504 6b7369 83502->83504 83515 6c0408 83502->83515 83508 6b70ed 83505->83508 83507 6b7248 __wsopen_s 83507->83502 83513 6b723d 83508->83513 83518 6a2041 83508->83518 83510 6b72a5 83511 6a2041 49 API calls 83510->83511 83510->83513 83512 6b72c3 83511->83512 83512->83513 83514 6a2041 49 API calls 83512->83514 83513->83507 83526 69d73d 83513->83526 83514->83513 83531 6bfb11 83515->83531 83517 6c0423 83517->83504 83519 6a204f 83518->83519 83523 6a2072 83518->83523 83520 6a2055 83519->83520 83519->83523 83522 69d73d std::_Stodx_v2 14 API calls 83520->83522 83525 6a205a __wsopen_s 83522->83525 83529 6a208d 49 API calls 4 library calls 83523->83529 83524 6a2088 83524->83510 83525->83510 83530 6b1e00 14 API calls 2 library calls 83526->83530 83528 69d742 83528->83507 83529->83524 83530->83528 83532 6bfb1d ___scrt_is_nonwritable_in_current_image 83531->83532 83533 6bfb24 83532->83533 83535 6bfb4f 83532->83535 83534 69d73d std::_Stodx_v2 14 API calls 83533->83534 83539 6bfb29 __wsopen_s 83534->83539 83540 6c00de 83535->83540 83539->83517 83541 6c00fb 83540->83541 83542 6c0129 83541->83542 83543 6c0110 83541->83543 83587 6badb9 83542->83587 83601 69d72a 14 API calls __dosmaperr 83543->83601 83547 6c014e 83600 6bfe25 CreateFileW 83547->83600 83548 6c0137 83602 69d72a 14 API calls __dosmaperr 83548->83602 83549 69d73d std::_Stodx_v2 14 API calls 83552 6bfb73 83549->83552 83586 6bfba6 LeaveCriticalSection __wsopen_s 83552->83586 83553 6c013c 83554 69d73d std::_Stodx_v2 14 API calls 83553->83554 83558 6c0115 83554->83558 83555 6c0204 GetFileType 83556 6c020f GetLastError 83555->83556 83557 6c0256 83555->83557 83605 69d707 14 API calls 3 library calls 83556->83605 83606 6bad04 15 API calls 3 library calls 83557->83606 83558->83549 83559 6c01d9 GetLastError 83604 69d707 14 API calls 3 library calls 83559->83604 83560 6c0187 83560->83555 83560->83559 83603 6bfe25 CreateFileW 83560->83603 83564 6c021d CloseHandle 83564->83558 83567 6c0246 83564->83567 83566 6c01cc 83566->83555 83566->83559 83569 69d73d std::_Stodx_v2 14 API calls 83567->83569 83568 6c0277 83570 6c02c3 83568->83570 83607 6c0034 70 API calls 3 library calls 83568->83607 83571 6c024b 83569->83571 83575 6c02ca 83570->83575 83623 6bfbd2 71 API calls 3 library calls 83570->83623 83571->83558 83574 6c02f8 83574->83575 83576 6c0306 83574->83576 83608 6b6b6c 83575->83608 83576->83552 83578 6c0382 CloseHandle 83576->83578 83624 6bfe25 CreateFileW 83578->83624 83580 6c03ad 83581 6c03e3 83580->83581 83582 6c03b7 GetLastError 83580->83582 83581->83552 83625 69d707 14 API calls 3 library calls 83582->83625 83584 6c03c3 83626 6baecc 15 API calls 3 library calls 83584->83626 83586->83539 83588 6badc5 ___scrt_is_nonwritable_in_current_image 83587->83588 83627 6acd41 EnterCriticalSection 83588->83627 83590 6bae13 83628 6baec3 83590->83628 83591 6badf1 83631 6bab93 15 API calls 3 library calls 83591->83631 83595 6badf6 83595->83590 83632 6bace1 EnterCriticalSection 83595->83632 83596 6badcc 83596->83590 83596->83591 83597 6bae60 EnterCriticalSection 83596->83597 83597->83590 83599 6bae6d LeaveCriticalSection 83597->83599 83599->83596 83600->83560 83601->83558 83602->83553 83603->83566 83604->83558 83605->83564 83606->83568 83607->83570 83634 6baf5d 83608->83634 83610 6b6b82 83645 6baecc 15 API calls 3 library calls 83610->83645 83612 6b6b7c 83612->83610 83613 6b6bb4 83612->83613 83615 6baf5d __wsopen_s 14 API calls 83612->83615 83613->83610 83616 6baf5d __wsopen_s 14 API calls 83613->83616 83614 6b6bda 83617 6b6bfc 83614->83617 83646 69d707 14 API calls 3 library calls 83614->83646 83618 6b6bab 83615->83618 83619 6b6bc0 FindCloseChangeNotification 83616->83619 83617->83552 83622 6baf5d __wsopen_s 14 API calls 83618->83622 83619->83610 83620 6b6bcc GetLastError 83619->83620 83620->83610 83622->83613 83623->83574 83624->83580 83625->83584 83626->83581 83627->83596 83633 6acd91 LeaveCriticalSection 83628->83633 83630 6bae33 83630->83547 83630->83548 83631->83595 83632->83590 83633->83630 83635 6baf6a 83634->83635 83636 6baf7f 83634->83636 83647 69d72a 14 API calls __dosmaperr 83635->83647 83641 6bafa4 83636->83641 83648 69d72a 14 API calls __dosmaperr 83636->83648 83639 6baf6f 83640 69d73d std::_Stodx_v2 14 API calls 83639->83640 83644 6baf77 __wsopen_s 83640->83644 83641->83612 83642 6bafaf 83643 69d73d std::_Stodx_v2 14 API calls 83642->83643 83643->83644 83644->83612 83645->83614 83646->83617 83647->83639 83648->83642 83649 6329e0 83650 632a00 83649->83650 83651 632a15 83649->83651 83681 698367 83650->83681 83655 632a2b 83651->83655 83665 632a54 83651->83665 83653 632b4c 83658 698367 __ehhandler$?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 83653->83658 83654 632a0f 83656 698367 __ehhandler$?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 83655->83656 83657 632a4e 83656->83657 83659 632b60 83658->83659 83661 632ae0 83661->83653 83662 632af0 83661->83662 83663 698367 __ehhandler$?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 83662->83663 83666 632b01 83663->83666 83664 632b07 83667 632b1f 83664->83667 83673 6a569d 83664->83673 83665->83653 83665->83664 83668 632a86 83665->83668 83667->83653 83670 632b34 83667->83670 83668->83653 83688 6a4762 52 API calls 4 library calls 83668->83688 83671 698367 __ehhandler$?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 83670->83671 83672 632b46 83671->83672 83674 6a56ab 83673->83674 83675 6a56bd __wsopen_s 83673->83675 83674->83675 83676 6a56b8 83674->83676 83677 6a56cc 83674->83677 83675->83667 83679 69d73d std::_Stodx_v2 14 API calls 83676->83679 83689 6a547e 83677->83689 83679->83675 83682 69836f 83681->83682 83683 698370 IsProcessorFeaturePresent 83681->83683 83682->83654 83685 699055 83683->83685 83863 699018 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 83685->83863 83687 699138 83687->83654 83688->83661 83690 6a548a ___scrt_is_nonwritable_in_current_image 83689->83690 83697 6a582c EnterCriticalSection 83690->83697 83692 6a5498 83698 6a54d9 83692->83698 83696 6a54b6 83696->83667 83697->83692 83706 6b2e58 83698->83706 83702 6a5508 83724 6b2f0b 68 API calls ___scrt_uninitialize_crt 83702->83724 83704 6a54a5 83705 6a54cd LeaveCriticalSection ___scrt_uninitialize_crt 83704->83705 83705->83696 83725 6b2e1c 83706->83725 83708 6b2e69 83730 6bec2a 83708->83730 83710 6b2e6f 83711 6a54ed 83710->83711 83737 6b2174 83710->83737 83715 6a551c 83711->83715 83718 6a552e 83715->83718 83719 6a5541 __wsopen_s 83715->83719 83716 6a553c 83717 69d73d std::_Stodx_v2 14 API calls 83716->83717 83717->83719 83718->83716 83718->83719 83722 6a5564 codecvt 83718->83722 83719->83702 83721 6b2e1c std::locale::_Setgloballocale 14 API calls 83721->83722 83722->83719 83722->83721 83751 6a4e41 83722->83751 83757 6b5ee6 83722->83757 83724->83704 83726 6b2e28 83725->83726 83727 6b2e3d 83725->83727 83728 69d73d std::_Stodx_v2 14 API calls 83726->83728 83727->83708 83729 6b2e2d __wsopen_s 83728->83729 83729->83708 83731 6bec37 83730->83731 83732 6bec44 83730->83732 83733 69d73d std::_Stodx_v2 14 API calls 83731->83733 83734 6bec50 83732->83734 83735 69d73d std::_Stodx_v2 14 API calls 83732->83735 83736 6bec3c __wsopen_s 83733->83736 83734->83710 83735->83736 83736->83710 83738 6b21b2 83737->83738 83742 6b2182 __cftoe 83737->83742 83739 69d73d std::_Stodx_v2 14 API calls 83738->83739 83741 6b21b0 83739->83741 83740 6b219d RtlAllocateHeap 83740->83741 83740->83742 83744 6b2098 83741->83744 83742->83738 83742->83740 83750 6af60f EnterCriticalSection LeaveCriticalSection moneypunct 83742->83750 83745 6b20a3 RtlFreeHeap 83744->83745 83746 6b20cc _free 83744->83746 83745->83746 83747 6b20b8 83745->83747 83746->83711 83748 69d73d std::_Stodx_v2 12 API calls 83747->83748 83749 6b20be GetLastError 83748->83749 83749->83746 83750->83742 83752 6a4e59 83751->83752 83753 6a4e7e 83751->83753 83752->83753 83754 6b2e1c std::locale::_Setgloballocale 14 API calls 83752->83754 83753->83722 83755 6a4e77 83754->83755 83756 6b5ee6 __wsopen_s 68 API calls 83755->83756 83756->83753 83758 6b5ef2 ___scrt_is_nonwritable_in_current_image 83757->83758 83759 6b5efa 83758->83759 83760 6b5f12 83758->83760 83823 69d72a 14 API calls __dosmaperr 83759->83823 83762 6b5fad 83760->83762 83766 6b5f44 83760->83766 83826 69d72a 14 API calls __dosmaperr 83762->83826 83763 6b5eff 83765 69d73d std::_Stodx_v2 14 API calls 83763->83765 83770 6b5f07 __wsopen_s 83765->83770 83780 6bace1 EnterCriticalSection 83766->83780 83767 6b5fb2 83769 69d73d std::_Stodx_v2 14 API calls 83767->83769 83769->83770 83770->83722 83771 6b5f4a 83772 6b5f7b 83771->83772 83773 6b5f66 83771->83773 83781 6b5fd8 83772->83781 83775 69d73d std::_Stodx_v2 14 API calls 83773->83775 83777 6b5f6b 83775->83777 83776 6b5f76 83825 6b5fa5 LeaveCriticalSection __wsopen_s 83776->83825 83824 69d72a 14 API calls __dosmaperr 83777->83824 83780->83771 83782 6b5ffa 83781->83782 83819 6b600b __wsopen_s 83781->83819 83783 6b5ffe 83782->83783 83786 6b604e 83782->83786 83844 69d72a 14 API calls __dosmaperr 83783->83844 83785 6b6003 83787 69d73d std::_Stodx_v2 14 API calls 83785->83787 83788 6b6061 83786->83788 83827 6b698d 83786->83827 83787->83819 83830 6b5b7f 83788->83830 83792 6b6077 83794 6b607b 83792->83794 83795 6b60a0 83792->83795 83793 6b60b6 83796 6b60ca 83793->83796 83797 6b610f WriteFile 83793->83797 83806 6b6096 83794->83806 83845 6b5b17 6 API calls __wsopen_s 83794->83845 83846 6b576d 53 API calls 6 library calls 83795->83846 83800 6b60ff 83796->83800 83801 6b60d5 83796->83801 83799 6b6133 GetLastError 83797->83799 83812 6b60ed 83797->83812 83799->83812 83837 6b5bf0 83800->83837 83802 6b60da 83801->83802 83803 6b60ef 83801->83803 83802->83806 83807 6b60df 83802->83807 83848 6b5db4 8 API calls 3 library calls 83803->83848 83809 6b6159 83806->83809 83810 6b6183 83806->83810 83806->83819 83847 6b5ccb 7 API calls 2 library calls 83807->83847 83813 6b6160 83809->83813 83814 6b6177 83809->83814 83817 69d73d std::_Stodx_v2 14 API calls 83810->83817 83810->83819 83812->83806 83815 69d73d std::_Stodx_v2 14 API calls 83813->83815 83850 69d707 14 API calls 3 library calls 83814->83850 83818 6b6165 83815->83818 83820 6b619b 83817->83820 83849 69d72a 14 API calls __dosmaperr 83818->83849 83819->83776 83851 69d72a 14 API calls __dosmaperr 83820->83851 83823->83763 83824->83776 83825->83770 83826->83767 83852 6b68f6 83827->83852 83831 6bec2a __wsopen_s 14 API calls 83830->83831 83832 6b5b90 83831->83832 83833 6b5be6 83832->83833 83862 6b1ca9 48 API calls 3 library calls 83832->83862 83833->83792 83833->83793 83835 6b5bb3 83835->83833 83836 6b5bcd GetConsoleMode 83835->83836 83836->83833 83841 6b5bff __wsopen_s 83837->83841 83838 6b5cb0 83839 698367 __ehhandler$?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 83838->83839 83840 6b5cc9 83839->83840 83840->83806 83841->83838 83842 6b5c6f WriteFile 83841->83842 83842->83841 83843 6b5cb2 GetLastError 83842->83843 83843->83838 83844->83785 83845->83806 83846->83806 83847->83812 83848->83812 83849->83819 83850->83819 83851->83819 83853 6baf5d __wsopen_s 14 API calls 83852->83853 83854 6b6908 83853->83854 83855 6b6921 SetFilePointerEx 83854->83855 83856 6b6910 83854->83856 83858 6b6939 GetLastError 83855->83858 83859 6b6915 83855->83859 83857 69d73d std::_Stodx_v2 14 API calls 83856->83857 83857->83859 83861 69d707 14 API calls 3 library calls 83858->83861 83859->83788 83861->83859 83862->83835 83863->83687 83864 6997ac 83865 6997bc 83864->83865 83868 68293c 83865->83868 83894 68269d 83868->83894 83871 6829a9 83872 6828da DloadReleaseSectionWriteAccess 8 API calls 83871->83872 83873 6829b4 RaiseException 83872->83873 83889 682ba2 83873->83889 83874 682a45 LoadLibraryExA 83876 682a58 GetLastError 83874->83876 83877 682aa6 83874->83877 83875 6829cd 83875->83874 83875->83877 83878 682b74 83875->83878 83879 682ab8 83875->83879 83881 682a81 83876->83881 83887 682a6b 83876->83887 83877->83879 83880 682ab1 FreeLibrary 83877->83880 83900 6828da 83878->83900 83879->83878 83882 682b16 GetProcAddress 83879->83882 83880->83879 83884 6828da DloadReleaseSectionWriteAccess 8 API calls 83881->83884 83882->83878 83883 682b26 GetLastError 83882->83883 83885 682b39 83883->83885 83888 682a8c RaiseException 83884->83888 83885->83878 83890 6828da DloadReleaseSectionWriteAccess 8 API calls 83885->83890 83887->83877 83887->83881 83888->83889 83891 682b5a RaiseException 83890->83891 83892 68269d ___delayLoadHelper2@8 7 API calls 83891->83892 83893 682b71 83892->83893 83893->83878 83895 6826a9 83894->83895 83896 6826ca 83894->83896 83908 682743 83895->83908 83896->83871 83896->83875 83898 6826ae 83898->83896 83913 68286c 83898->83913 83901 6828ec 83900->83901 83902 68290e 83900->83902 83903 682743 DloadReleaseSectionWriteAccess 4 API calls 83901->83903 83902->83889 83904 6828f1 83903->83904 83905 682909 83904->83905 83906 68286c DloadProtectSection 3 API calls 83904->83906 83920 682910 GetModuleHandleW GetProcAddress GetProcAddress ReleaseSRWLockExclusive DloadGetSRWLockFunctionPointers 83905->83920 83906->83905 83918 6826d0 GetModuleHandleW GetProcAddress GetProcAddress 83908->83918 83910 682748 83911 682760 AcquireSRWLockExclusive 83910->83911 83912 682764 83910->83912 83911->83898 83912->83898 83915 682881 DloadObtainSection 83913->83915 83914 682887 83914->83896 83915->83914 83916 6828bc VirtualProtect 83915->83916 83919 682782 VirtualQuery GetSystemInfo 83915->83919 83916->83914 83918->83910 83919->83916 83920->83902 83921 635204 RegOpenKeyExW 83922 6352e2 83921->83922 83923 635244 RegQueryValueExW 83921->83923 83924 69e960 ___vcrt_freefls@4 14 API calls 83922->83924 83925 6352ca RegCloseKey 83923->83925 83930 635275 83923->83930 83927 6352ea GetLastError 83924->83927 83925->83922 83926 63538b 83925->83926 83928 6353de OutputDebugStringW 83926->83928 83935 6353fd __cftof 83926->83935 83927->83926 83971 634f50 83928->83971 83930->83925 83931 6352b4 SetLastError RegCloseKey 83930->83931 83931->83922 83932 63549c OutputDebugStringW 83987 634e60 83932->83987 83934 635703 83937 63570c LoadLibraryExW 83934->83937 83949 6356f7 83934->83949 83936 636ae0 5 API calls 83935->83936 83940 6353f0 83935->83940 83936->83940 83941 63571d GetLastError 83937->83941 83937->83949 83938 6354b6 83942 634e60 3 API calls 83938->83942 83968 635584 83938->83968 83939 6355c4 84003 634dc0 83939->84003 83940->83932 83940->83968 83943 69e960 ___vcrt_freefls@4 14 API calls 83941->83943 83944 6354c8 83942->83944 83943->83949 83946 6354e8 83944->83946 83950 635510 83944->83950 83952 69e960 ___vcrt_freefls@4 14 API calls 83944->83952 83948 6a594f _Yarn 15 API calls 83946->83948 83947 6356e7 83947->83949 83954 69e960 ___vcrt_freefls@4 14 API calls 83947->83954 83948->83950 83951 698367 __ehhandler$?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 83949->83951 83950->83939 83955 634e60 3 API calls 83950->83955 83956 63577e 83951->83956 83952->83946 83954->83949 83957 635531 83955->83957 83991 634cc0 83957->83991 83959 634dc0 3 API calls 83960 63566a 83959->83960 84011 6a594f 83960->84011 83963 635546 __cftof 83963->83939 83996 636ae0 83963->83996 83964 634dc0 3 API calls 83965 6356ae 83964->83965 83967 634cc0 54 API calls 83965->83967 83969 6356cd OutputDebugStringW 83967->83969 83968->83934 83968->83939 84018 69e960 83969->84018 83972 634f98 83971->83972 83973 635099 83971->83973 83972->83973 83974 634fae GetCurrentDirectoryW 83972->83974 83975 698367 __ehhandler$?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 83973->83975 83976 634fc5 83974->83976 83977 63500b GetLastError 83974->83977 83978 635109 83975->83978 83980 634fd6 GetCurrentDirectoryW 83976->83980 83979 634fec 83977->83979 83978->83940 83979->83973 83982 6a594f _Yarn 15 API calls 83979->83982 83980->83979 83981 634ff2 GetLastError 83980->83981 83981->83979 83983 635045 83982->83983 83983->83973 83984 634cc0 54 API calls 83983->83984 83985 635064 __cftof 83984->83985 83985->83973 83986 636ae0 5 API calls 83985->83986 83986->83973 83988 634e73 83987->83988 83990 634e7c 83987->83990 83989 634dc0 3 API calls 83988->83989 83989->83990 83990->83938 83992 634d2d 83991->83992 83993 634cce swprintf 83991->83993 83992->83963 83993->83992 84021 6a1faa 83993->84021 83997 636bb2 83996->83997 83998 636afc 83996->83998 83999 698367 __ehhandler$?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 83997->83999 84001 698367 __ehhandler$?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 83998->84001 84000 636bc0 83999->84000 84000->83968 84002 636bac 84001->84002 84002->83968 84004 634e49 84003->84004 84009 634dce 84003->84009 84004->83947 84004->83959 84005 634dec GetModuleFileNameW 84006 634e23 84005->84006 84007 634e02 GetLastError 84005->84007 84008 634e2f GetLastError 84006->84008 84010 634e28 84006->84010 84007->84006 84007->84009 84008->84010 84009->84005 84010->84004 84016 6b2174 __cftoe 84011->84016 84012 6b21b2 84013 69d73d std::_Stodx_v2 14 API calls 84012->84013 84015 635697 84013->84015 84014 6b219d RtlAllocateHeap 84014->84015 84014->84016 84015->83947 84015->83964 84016->84012 84016->84014 84040 6af60f EnterCriticalSection LeaveCriticalSection moneypunct 84016->84040 84019 6b2098 _free 14 API calls 84018->84019 84020 69e978 84019->84020 84020->83947 84024 69f2ec 84021->84024 84025 69f32c 84024->84025 84026 69f314 84024->84026 84025->84026 84028 69f334 84025->84028 84027 69d73d std::_Stodx_v2 14 API calls 84026->84027 84030 69f319 __wsopen_s 84027->84030 84037 69e6db 48 API calls 2 library calls 84028->84037 84032 698367 __ehhandler$?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 84030->84032 84031 69f344 swprintf 84038 6a01c8 54 API calls 3 library calls 84031->84038 84033 634cf9 84032->84033 84033->83963 84036 69f3cb 84039 69fafc 14 API calls _free 84036->84039 84037->84031 84038->84036 84039->84030 84040->84016 84041 698aa2 84042 698aae ___scrt_is_nonwritable_in_current_image 84041->84042 84069 6983f9 84042->84069 84044 698ab5 84045 698c08 84044->84045 84055 698adf ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock std::locale::_Setgloballocale 84044->84055 84088 6993f2 4 API calls 2 library calls 84045->84088 84047 698c0f 84081 6ae9fc 84047->84081 84051 698c1d 84052 698afe 84053 698b80 84077 69950d GetStartupInfoW __cftof 84053->84077 84055->84052 84055->84053 84057 698b78 84055->84057 84056 698b85 84078 6259aa 84056->84078 84084 6ac768 54 API calls 4 library calls 84057->84084 84060 698b7f 84060->84053 84063 698ba1 84063->84047 84064 698ba5 84063->84064 84065 698bae 84064->84065 84086 6ae9b1 23 API calls std::locale::_Setgloballocale 84064->84086 84087 69856a 79 API calls ___scrt_uninitialize_crt 84065->84087 84068 698bb6 84068->84052 84070 698402 84069->84070 84090 699215 IsProcessorFeaturePresent 84070->84090 84072 69840e 84091 69bd89 10 API calls 2 library calls 84072->84091 84074 698413 84075 698417 84074->84075 84092 69bda8 7 API calls 2 library calls 84074->84092 84075->84044 84077->84056 84093 624e1f 84078->84093 88732 6ae89a 84081->88732 84084->84060 84085 699543 GetModuleHandleW 84085->84063 84086->84065 84087->84068 84088->84047 84089 6ae9c0 23 API calls std::locale::_Setgloballocale 84089->84051 84090->84072 84091->84074 84092->84075 84336 64d6d0 GetModuleHandleW 84093->84336 84095 624e6c 84096 624ec6 84095->84096 84590 629bb0 InitOnceBeginInitialize 84095->84590 84340 624d63 84096->84340 84101 624ee0 84104 629bb0 125 API calls 84101->84104 84102 624f39 CoInitializeEx 84106 624f48 84102->84106 84109 624ee5 84104->84109 84107 624f56 84106->84107 84360 625a4f 84106->84360 84397 698760 84107->84397 84112 629940 164 API calls 84109->84112 84115 624ef5 84112->84115 84117 621b84 79 API calls 84115->84117 84119 624f16 84117->84119 84118 624ebb 84620 62136c 84118->84620 84623 621be0 76 API calls 84119->84623 84123 624f91 84125 624ff1 84123->84125 84126 624f9b 84123->84126 84124 624f26 84127 62136c 163 API calls 84124->84127 84128 698760 27 API calls 84125->84128 84129 629bb0 125 API calls 84126->84129 84130 624f31 84127->84130 84131 625004 84128->84131 84132 624fa0 84129->84132 84133 6258e3 CloseHandle 84130->84133 84134 6258ef 84130->84134 84404 625db6 84131->84404 84135 629940 164 API calls 84132->84135 84133->84134 84136 698367 __ehhandler$?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 84134->84136 84137 624fb0 84135->84137 84138 62590c 84136->84138 84140 621b84 79 API calls 84137->84140 84138->84085 84141 624fd1 84140->84141 84624 621be0 76 API calls 84141->84624 84142 625020 84144 62507b __cftof 84142->84144 84145 62502e 84142->84145 84151 698760 27 API calls 84144->84151 84147 629bb0 125 API calls 84145->84147 84146 624fe1 84148 62136c 163 API calls 84146->84148 84149 625033 84147->84149 84157 624fec 84148->84157 84150 629940 164 API calls 84149->84150 84152 625043 84150->84152 84153 6250c0 84151->84153 84154 621b84 79 API calls 84152->84154 84155 6250d6 84153->84155 84626 636bd0 29 API calls 3 library calls 84153->84626 84156 62505b 84154->84156 84408 625e16 84155->84408 84625 621be0 76 API calls 84156->84625 84589 6259c2 ReleaseMutex 84157->84589 84162 6258ce 84162->84130 84165 6258d4 CoUninitialize 84162->84165 84163 6250e7 84166 6250f2 84163->84166 84170 625143 84163->84170 84164 62506b 84167 62136c 163 API calls 84164->84167 84165->84130 84168 629bb0 125 API calls 84166->84168 84167->84157 84169 6250f7 84168->84169 84171 629940 164 API calls 84169->84171 84414 653670 84170->84414 84173 625107 84171->84173 84175 621b84 79 API calls 84173->84175 84178 625123 84175->84178 84176 6251f7 CommandLineToArgvW 84187 625284 __cftof 84176->84187 84188 625235 84176->84188 84177 6251ab 84179 629bb0 125 API calls 84177->84179 84627 621be0 76 API calls 84178->84627 84181 6251b0 84179->84181 84183 629940 164 API calls 84181->84183 84182 625133 84184 62136c 163 API calls 84182->84184 84186 6251c0 84183->84186 84193 62513e 84184->84193 84189 621b84 79 API calls 84186->84189 84192 625296 GetModuleFileNameW 84187->84192 84190 629bb0 125 API calls 84188->84190 84191 6251dc 84189->84191 84195 62523a 84190->84195 84628 621be0 76 API calls 84191->84628 84198 6252b2 84192->84198 84199 62531d 84192->84199 84653 625946 IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 84193->84653 84200 629940 164 API calls 84195->84200 84197 6251ec 84207 62136c 163 API calls 84197->84207 84202 629bb0 125 API calls 84198->84202 84448 62d730 84199->84448 84203 62524a 84200->84203 84205 6252b7 84202->84205 84206 621b84 79 API calls 84203->84206 84204 62532c __cftof 84210 625344 GetLongPathNameW 84204->84210 84208 629940 164 API calls 84205->84208 84209 625266 84206->84209 84207->84193 84211 6252c7 84208->84211 84629 621be0 76 API calls 84209->84629 84213 62536d 84210->84213 84252 625416 84210->84252 84214 621b84 79 API calls 84211->84214 84215 625276 GetLastError 84473 62171d 84252->84473 84337 64d6fd 84336->84337 84338 64d6df GetProcAddress 84336->84338 84337->84095 84338->84337 84339 64d6ef 84338->84339 84339->84095 84654 624c8e GetCurrentProcessId 84340->84654 84343 624d7f CreateMutexW 84344 624d92 84343->84344 84345 624df4 WaitForSingleObject 84343->84345 84347 629bb0 125 API calls 84344->84347 84346 624e06 84345->84346 84348 624df0 84345->84348 84346->84348 84349 624e0b CloseHandle 84346->84349 84350 624d97 84347->84350 84348->84101 84348->84102 84349->84348 84351 629940 164 API calls 84350->84351 84352 624da5 84351->84352 84353 621b84 79 API calls 84352->84353 84354 624dc2 84353->84354 84666 621be0 76 API calls 84354->84666 84356 624dd0 GetLastError 84357 626140 75 API calls 84356->84357 84358 624de7 84357->84358 84359 62136c 163 API calls 84358->84359 84359->84348 84361 625a5e __EH_prolog3_GS 84360->84361 85153 625c1e 84361->85153 84364 625a78 84365 629bb0 125 API calls 84364->84365 84367 625a7d 84365->84367 84366 625b92 _com_issue_error 84368 629940 164 API calls 84367->84368 84369 625a8d 84368->84369 84371 621b84 79 API calls 84369->84371 84370 625acc 84370->84366 84372 625af5 84370->84372 84373 625b38 84370->84373 84374 625aa9 84371->84374 84375 629bb0 125 API calls 84372->84375 84377 629bb0 125 API calls 84373->84377 85160 621be0 76 API calls 84374->85160 84378 625afa 84375->84378 84380 625b3d 84377->84380 84381 629940 164 API calls 84378->84381 84379 625ab9 85161 626300 75 API calls 84379->85161 84383 629940 164 API calls 84380->84383 84384 625b0a 84381->84384 84386 625b4d 84383->84386 84387 621b84 79 API calls 84384->84387 84385 625ac7 84390 62136c 163 API calls 84385->84390 84388 621b84 79 API calls 84386->84388 84391 625b26 84387->84391 84389 625b69 84388->84389 85163 621be0 76 API calls 84389->85163 84393 625b84 84390->84393 85162 621be0 76 API calls 84391->85162 85164 698def 5 API calls __ehhandler$?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 84393->85164 84398 698713 moneypunct 27 API calls 84397->84398 84399 624f78 84398->84399 84400 625d57 84399->84400 84401 625d63 __EH_prolog3 84400->84401 84402 698713 moneypunct 27 API calls 84401->84402 84403 625d7c moneypunct std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 84402->84403 84403->84123 84405 625dc2 __EH_prolog3 84404->84405 84406 698713 moneypunct 27 API calls 84405->84406 84407 625ddb moneypunct 84406->84407 84407->84142 84409 625e22 __EH_prolog3 84408->84409 84410 698713 moneypunct 27 API calls 84409->84410 84411 625e3b 84410->84411 85165 625eee 84411->85165 84413 625e6c moneypunct 84413->84163 84415 6536ae 84414->84415 84416 653977 84415->84416 85170 636d24 84415->85170 84422 6539df 84416->84422 85344 658650 84416->85344 84418 653750 84418->84416 84419 698713 moneypunct 27 API calls 84418->84419 84420 65375f 84419->84420 84423 653799 84420->84423 85337 658ba0 27 API calls moneypunct 84420->85337 84424 698367 __ehhandler$?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 84422->84424 85216 659400 GetModuleHandleW 84423->85216 84426 6251a7 84424->84426 84426->84176 84426->84177 84449 62d796 84448->84449 84450 62d76f 84448->84450 84451 62d7ab 84449->84451 84460 62d8bc 84449->84460 84450->84204 84452 62da86 84451->84452 84457 62d80b 84451->84457 84463 62d7de codecvt std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 84451->84463 86397 6234d0 21 API calls collate 84452->86397 84454 62da90 86398 6234d0 21 API calls collate 84454->86398 84455 62da8b Concurrency::cancel_current_task 84455->84454 84457->84455 84458 62d872 84457->84458 84459 62d84b 84457->84459 84458->84463 84466 698713 moneypunct 27 API calls 84458->84466 84459->84455 84462 62d856 84459->84462 84460->84454 84460->84455 84460->84463 84467 62d953 84460->84467 84468 62d97a 84460->84468 84461 69d60f 11 API calls 84464 62da9a 84461->84464 84463->84461 84470 62da69 std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 84463->84470 84466->84463 84467->84455 84469 62d95e 84467->84469 84468->84463 84472 698713 moneypunct 27 API calls 84468->84472 84470->84204 84472->84463 84589->84162 84591 629c45 84590->84591 84592 629bef 84590->84592 88608 6a41c9 48 API calls std::locale::_Setgloballocale 84591->88608 84593 629c27 84592->84593 88578 629c50 84592->88578 84596 698367 __ehhandler$?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 84593->84596 84599 624e7a 84596->84599 84600 629940 84599->84600 84601 629985 84600->84601 84602 629a1c 84600->84602 84601->84602 84606 62998e __cftof 84601->84606 88687 62b420 163 API calls 3 library calls 84602->88687 84604 629a00 std::ios_base::_Ios_base_dtor 84605 698367 __ehhandler$?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 84604->84605 84607 624e8a 84605->84607 88684 62b420 163 API calls 3 library calls 84606->88684 84615 621b84 84607->84615 84609 6299d5 88685 629820 76 API calls 84609->88685 84611 6299e9 88686 62b690 79 API calls std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 84611->88686 84613 6299f8 84614 62b8a0 163 API calls 84613->84614 84614->84604 84616 621bb6 84615->84616 84617 621bbf 84615->84617 88688 6280b0 84616->88688 84619 621be0 76 API calls 84617->84619 84619->84118 84621 62b8a0 163 API calls 84620->84621 84622 62139a std::ios_base::_Ios_base_dtor 84621->84622 84622->84096 84623->84124 84624->84146 84625->84164 84626->84155 84627->84182 84628->84197 84629->84215 84653->84157 84655 624cb0 CreateToolhelp32Snapshot 84654->84655 84656 624cdd 84655->84656 84657 624cc5 Process32FirstW 84655->84657 84656->84655 84659 624ce3 Process32NextW 84656->84659 84661 624cf9 FindCloseChangeNotification 84656->84661 84663 6a2041 49 API calls 84656->84663 84664 623899 5 API calls 84656->84664 84665 624d44 84656->84665 84667 634590 84656->84667 84657->84656 84659->84656 84660 698367 __ehhandler$?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 84662 624d58 84660->84662 84661->84656 84662->84343 84662->84348 84663->84656 84664->84656 84665->84660 84666->84356 84678 634760 84667->84678 84670 698367 __ehhandler$?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 84671 63468c 84670->84671 84671->84656 84672 634693 84689 69d60f 84672->84689 84673 634650 std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 84673->84670 84693 634200 OpenProcess 84678->84693 84680 6347a8 84682 6347b2 84680->84682 84765 62daa0 29 API calls 4 library calls 84680->84765 84684 634935 84682->84684 84686 6347e2 std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 84682->84686 84683 698367 __ehhandler$?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 84687 634604 84683->84687 84685 69d60f 11 API calls 84684->84685 84688 63493a 84685->84688 84686->84683 84687->84672 84687->84673 84690 69d61e 84689->84690 85143 69d62c IsProcessorFeaturePresent 84690->85143 84692 69d62b 84694 634267 84693->84694 84702 634310 84693->84702 84695 629bb0 125 API calls 84694->84695 84696 63426c 84695->84696 84698 629940 164 API calls 84696->84698 84700 63427c 84698->84700 84699 634351 QueryFullProcessImageNameW 84701 634375 GetLastError 84699->84701 84699->84702 84704 621b84 79 API calls 84700->84704 84701->84702 84705 634387 84701->84705 84703 63447f 84702->84703 84766 6346c0 84702->84766 84706 629bb0 125 API calls 84703->84706 84707 634298 84704->84707 84708 629bb0 125 API calls 84705->84708 84710 634484 84706->84710 84798 621cc0 76 API calls 84707->84798 84709 63438c 84708->84709 84712 629940 164 API calls 84709->84712 84713 629940 164 API calls 84710->84713 84715 63439c 84712->84715 84716 634494 84713->84716 84714 6342a3 84717 626140 75 API calls 84714->84717 84719 621b84 79 API calls 84715->84719 84720 621b84 79 API calls 84716->84720 84718 6342b1 84717->84718 84721 634940 76 API calls 84718->84721 84722 6343b8 84719->84722 84723 6344b0 84720->84723 84725 6342bc GetLastError 84721->84725 84772 6349d0 84722->84772 84799 621be0 76 API calls 84723->84799 84728 626140 75 API calls 84725->84728 84727 6344c0 84730 626140 75 API calls 84727->84730 84731 6342d3 84728->84731 84729 6343c3 84732 626140 75 API calls 84729->84732 84733 6344ce 84730->84733 84734 62b8a0 163 API calls 84731->84734 84735 6343d1 84732->84735 84800 634a60 76 API calls 84733->84800 84743 6342de std::ios_base::_Ios_base_dtor 84734->84743 84777 634940 84735->84777 84738 6344d9 84740 624190 5 API calls 84738->84740 84739 6343dc 84741 626140 75 API calls 84739->84741 84742 6344f5 84740->84742 84744 6343ea 84741->84744 84745 62b8a0 163 API calls 84742->84745 84747 698367 __ehhandler$?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 84743->84747 84782 62b8a0 84744->84782 84750 634462 std::ios_base::_Ios_base_dtor std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 84745->84750 84748 63457a 84747->84748 84748->84680 84749 6343f5 std::ios_base::_Ios_base_dtor 84749->84750 84752 634581 84749->84752 84750->84743 84751 63455a CloseHandle 84750->84751 84751->84743 84753 69d60f 11 API calls 84752->84753 84754 634586 84753->84754 84755 634760 203 API calls 84754->84755 84756 634604 84755->84756 84759 634693 84756->84759 84760 634650 std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 84756->84760 84757 698367 __ehhandler$?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 84758 63468c 84757->84758 84758->84680 84761 69d60f 11 API calls 84759->84761 84760->84757 84762 634698 84761->84762 84763 6346b3 84762->84763 84764 6346ac CloseHandle 84762->84764 84763->84680 84764->84763 84765->84682 84767 6346d3 84766->84767 84768 6346e9 84766->84768 84767->84699 84769 6346fa 84768->84769 84801 628eb0 28 API calls 4 library calls 84768->84801 84769->84699 84771 63474a 84771->84699 84773 634a3e 84772->84773 84774 634a0c 84772->84774 84773->84729 84802 6220a0 76 API calls 4 library calls 84774->84802 84776 634a1e 84776->84729 84778 6349ae 84777->84778 84779 63497c 84777->84779 84778->84739 84803 6220a0 76 API calls 4 library calls 84779->84803 84781 63498e 84781->84739 84783 62b8ff 84782->84783 84786 62b96c std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 84782->84786 84804 629ab0 84783->84804 84971 62cd20 84786->84971 84787 62b910 84809 62ba20 84787->84809 84788 62b9e0 84788->84749 84790 62b927 84823 630890 84790->84823 84893 6320f0 84790->84893 84897 6307c0 84790->84897 84791 62b93c 84791->84786 84792 62ba0d 84791->84792 84793 69d60f 11 API calls 84792->84793 84794 62ba12 84793->84794 84798->84714 84799->84727 84800->84738 84801->84771 84802->84776 84803->84781 84805 629b1a 84804->84805 84806 629aec 84804->84806 84805->84787 84974 6220a0 76 API calls 4 library calls 84806->84974 84808 629afa 84808->84787 84812 62ba83 84809->84812 84810 62bba2 84989 6234d0 21 API calls collate 84810->84989 84812->84810 84814 62bb9d Concurrency::cancel_current_task 84812->84814 84816 62bb43 84812->84816 84817 62bb64 84812->84817 84820 62baca codecvt 84812->84820 84813 62bb50 84815 69d60f 11 API calls 84813->84815 84813->84820 84814->84810 84818 62bbac 84815->84818 84816->84814 84819 62bb4a 84816->84819 84817->84820 84822 698713 moneypunct 27 API calls 84817->84822 84975 698713 84819->84975 84820->84790 84822->84820 84990 683bab 84823->84990 84826 631045 85100 683faf 84826->85100 84827 6308e8 84829 6308f4 ConvertStringSecurityDescriptorToSecurityDescriptorW 84827->84829 84832 630a51 __cftof 84827->84832 84834 630911 84829->84834 84844 630fdb std::ios_base::_Ios_base_dtor __Mtx_unlock 84829->84844 84830 63104b 84831 69d60f 11 API calls 84830->84831 84839 630f65 84831->84839 85023 633110 84832->85023 84993 62f520 84834->84993 84835 698367 __ehhandler$?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 84837 63103f 84835->84837 84837->84791 84838 630a84 84841 630fa9 84838->84841 84847 698713 moneypunct 27 API calls 84838->84847 84891 630c43 codecvt 84838->84891 84840 630991 85008 62e640 84840->85008 85099 632b90 73 API calls std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 84841->85099 84844->84835 84851 630ae1 __cftof 84847->84851 84850 6309ec std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 84854 630a31 84850->84854 84855 630a1d 84850->84855 85061 683367 84851->85061 84854->84832 84855->84844 85038 6289b0 84891->85038 84894 632123 84893->84894 84895 6320f9 84893->84895 84894->84791 84895->84894 85119 6a4ef7 84895->85119 84898 6307cb std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 84897->84898 84899 69d60f 11 API calls 84898->84899 84901 63083b __Mtx_destroy_in_situ std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 84898->84901 84900 630884 84899->84900 84902 683bab 13 API calls 84900->84902 84901->84791 84903 6308dd 84902->84903 84904 631045 84903->84904 84905 6308e8 84903->84905 84906 683faf 79 API calls 84904->84906 84907 6308f4 ConvertStringSecurityDescriptorToSecurityDescriptorW 84905->84907 84910 630a51 __cftof 84905->84910 84908 63104b 84906->84908 84912 630911 84907->84912 84922 630fdb std::ios_base::_Ios_base_dtor __Mtx_unlock 84907->84922 84909 69d60f 11 API calls 84908->84909 84917 630f65 84909->84917 84911 633110 102 API calls 84910->84911 84916 630a84 84911->84916 84914 62f520 28 API calls 84912->84914 84913 698367 __ehhandler$?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 84915 63103f 84913->84915 84918 630991 84914->84918 84915->84791 84919 630fa9 84916->84919 84925 698713 moneypunct 27 API calls 84916->84925 84969 630c43 codecvt 84916->84969 85135 6228d1 27 API calls 3 library calls 84917->85135 84921 62e640 87 API calls 84918->84921 85134 632b90 73 API calls std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 84919->85134 84924 6309a4 84921->84924 84922->84913 84924->84908 84928 6309ec std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 84924->84928 84929 630ae1 __cftof 84925->84929 84926 6289b0 27 API calls 84930 630d38 84926->84930 84927 631087 84931 69a332 Concurrency::cancel_current_task RaiseException 84927->84931 84932 630a31 84928->84932 84933 630a1d 84928->84933 84938 683367 std::_Lockit::_Lockit 7 API calls 84929->84938 84937 622c9c 5 API calls 84930->84937 84945 630d68 84930->84945 84934 631098 84931->84934 84932->84910 84936 630a42 LocalFree 84932->84936 84933->84922 84935 630a25 LocalFree 84933->84935 84935->84922 84936->84910 84937->84945 84940 630b0d 84938->84940 84939 622c9c 5 API calls 84941 630e1f 84939->84941 85127 683184 72 API calls 2 library calls 84940->85127 84951 630e6e 84941->84951 84970 632380 70 API calls 84941->84970 84943 630b55 85128 6833f6 48 API calls 4 library calls 84943->85128 84945->84917 84945->84919 84945->84939 84946 630b61 84951->84919 84953 633030 73 API calls 84951->84953 84969->84926 84970->84951 85136 62cc80 84971->85136 84973 62cd2f std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 84973->84788 84974->84808 84977 698718 84975->84977 84976 6a594f _Yarn 15 API calls 84976->84977 84977->84976 84978 698732 84977->84978 84979 6af60f moneypunct EnterCriticalSection LeaveCriticalSection 84977->84979 84981 623599 moneypunct 84977->84981 84978->84813 84979->84977 84980 69873e 84980->84980 84981->84980 84982 69a332 Concurrency::cancel_current_task RaiseException 84981->84982 84983 6235c5 84981->84983 84982->84981 84984 698713 moneypunct 27 API calls 84983->84984 84986 6235cb 84984->84986 84985 6235d2 84985->84813 84986->84985 84987 69d62c __Getcoll 11 API calls 84986->84987 84988 69d62b 84987->84988 84991 68394b 13 API calls 84990->84991 84992 6308dd 84991->84992 84992->84826 84992->84827 84996 62f541 codecvt 84993->84996 84997 62f571 84993->84997 84994 62f677 84995 6234d0 collate 21 API calls 84994->84995 85006 62f5e4 codecvt 84995->85006 84996->84840 84997->84994 84999 62f672 Concurrency::cancel_current_task 84997->84999 85001 62f5d3 84997->85001 85002 62f5fa 84997->85002 84998 69d60f 11 API calls 85000 62f681 84998->85000 84999->84994 85001->84999 85003 62f5de 85001->85003 85005 698713 moneypunct 27 API calls 85002->85005 85002->85006 85004 698713 moneypunct 27 API calls 85003->85004 85004->85006 85005->85006 85006->84998 85007 62f658 std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 85006->85007 85007->84840 85009 62e680 GetFileAttributesW 85008->85009 85010 62e67e 85008->85010 85014 62e690 85009->85014 85019 62e724 std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 85009->85019 85010->85009 85011 62e736 CreateDirectoryW 85012 62e742 GetLastError 85011->85012 85013 62e74f 85011->85013 85012->85013 85013->84830 85013->84850 85014->85014 85015 62f520 28 API calls 85014->85015 85014->85019 85016 62e6ec 85015->85016 85017 62d6d0 83 API calls 85016->85017 85018 62e6f8 85017->85018 85018->85019 85020 62e77d 85018->85020 85019->85011 85024 62be30 78 API calls 85023->85024 85025 6331ba 85024->85025 85026 62bbb0 57 API calls 85025->85026 85027 6331e3 85026->85027 85028 6840b7 73 API calls 85027->85028 85031 633388 85027->85031 85029 633281 85028->85029 85030 63328f 85029->85030 85029->85031 85034 633400 std::locale::_Locimp::_Makeushloc 75 API calls 85030->85034 85032 6228d1 27 API calls 85031->85032 85037 633333 85031->85037 85033 6333e3 85032->85033 85035 69a332 Concurrency::cancel_current_task RaiseException 85033->85035 85034->85037 85036 6333f1 85035->85036 85037->84838 85039 6289ff 85038->85039 85040 622c9c IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 85039->85040 85062 68337d 85061->85062 85063 683376 85061->85063 85099->84844 85101 683fba 85100->85101 85102 6a41c9 85101->85102 85105 683fcd 85101->85105 85103 6b4be4 std::locale::_Setgloballocale EnterCriticalSection LeaveCriticalSection 85102->85103 85106 6a41ce 85103->85106 85104 683fdc 78 API calls 85104->85105 85105->85104 85107 6a41d9 85106->85107 85110 6b4c32 std::locale::_Setgloballocale 48 API calls 85106->85110 85108 6a41e3 IsProcessorFeaturePresent 85107->85108 85109 6a4202 85107->85109 85111 6a41ef 85108->85111 85112 6ae9c0 std::locale::_Setgloballocale 23 API calls 85109->85112 85110->85107 85113 69d453 std::locale::_Setgloballocale 8 API calls 85111->85113 85114 6a420c 85112->85114 85113->85109 85120 6a4f09 85119->85120 85124 6a4f12 ___scrt_uninitialize_crt 85119->85124 85121 6a4d9c ___scrt_uninitialize_crt 72 API calls 85120->85121 85122 6a4f0f 85121->85122 85122->84894 85123 6a4f23 85123->84894 85124->85123 85125 6a4d3c 72 API calls 85124->85125 85126 6a4f4a 85125->85126 85126->84894 85127->84943 85128->84946 85134->84922 85135->84927 85137 62cccb std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 85136->85137 85138 62cc89 85136->85138 85137->84973 85138->85137 85139 69d60f 11 API calls 85138->85139 85140 62cd1f 85139->85140 85141 62cc80 11 API calls 85140->85141 85142 62cd2f std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 85141->85142 85142->84973 85144 69d638 85143->85144 85147 69d453 85144->85147 85148 69d46f __cftof std::locale::_Setgloballocale 85147->85148 85149 69d49b IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 85148->85149 85152 69d56c std::locale::_Setgloballocale 85149->85152 85150 698367 __ehhandler$?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 85151 69d58a GetCurrentProcess TerminateProcess 85150->85151 85151->84692 85152->85150 85154 625c64 CoCreateInstance 85153->85154 85155 625c54 85153->85155 85156 625c95 85154->85156 85157 625c86 OleRun 85154->85157 85155->85154 85158 698367 __ehhandler$?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 85156->85158 85157->85156 85159 625a71 85158->85159 85159->84364 85159->84370 85160->84379 85161->84385 85162->84379 85163->84385 85166 625ef5 85165->85166 85168 625efc std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 85165->85168 85169 625f8a 5 API calls 2 library calls 85166->85169 85168->84413 85171 636d30 85170->85171 85176 636ec8 std::ios_base::_Ios_base_dtor __Mtx_unlock 85170->85176 85172 636dff 85171->85172 85173 636d3e 85171->85173 85174 698760 27 API calls 85172->85174 85175 698760 27 API calls 85173->85175 85177 636e09 85174->85177 85178 636d48 85175->85178 85176->84418 85189 636db6 85177->85189 85377 63ce00 85177->85377 85179 63ce00 210 API calls 85178->85179 85178->85189 85181 636d63 85179->85181 85505 683b8a 85181->85505 85183 636e52 85186 629bb0 125 API calls 85183->85186 85184 636ed1 85448 63e380 85184->85448 85188 636e57 85186->85188 85187 698713 moneypunct 27 API calls 85187->85189 85190 629940 164 API calls 85188->85190 85189->85183 85189->85184 85192 636e67 85190->85192 85193 621b84 79 API calls 85192->85193 85195 636e83 85193->85195 85508 638e90 76 API calls 85195->85508 85217 659485 GetProcAddress 85216->85217 85220 6594c2 85216->85220 85218 659497 GetCurrentProcess 85217->85218 85217->85220 85219 6594b1 85218->85219 85219->85220 86294 62347e 85220->86294 85222 6594fc 85223 62347e 28 API calls 85222->85223 85224 65954c 85223->85224 86298 658c60 85224->86298 85337->84423 85345 658b75 85344->85345 85351 6586ab swprintf 85344->85351 86396 658400 91 API calls 3 library calls 85345->86396 85347 658b89 85364 6588f1 std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 85347->85364 85349 698367 __ehhandler$?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 85350 658b71 85349->85350 85350->84422 85352 6a1faa swprintf 54 API calls 85351->85352 85353 65870d __cftof 85351->85353 85359 658895 85351->85359 86389 629050 28 API calls 85351->86389 85352->85351 86390 641820 85353->86390 85356 698713 moneypunct 27 API calls 85357 658815 85356->85357 85358 658834 85357->85358 85360 683084 std::locale::_Init 57 API calls 85357->85360 85362 624300 5 API calls 85358->85362 86376 624880 85359->86376 85360->85358 85363 6589da 85362->85363 85364->85349 85378 698713 moneypunct 27 API calls 85377->85378 85379 63ce81 85378->85379 85380 698713 moneypunct 27 API calls 85379->85380 85381 63cf42 85380->85381 85382 698713 moneypunct 27 API calls 85381->85382 85383 63cfa0 85382->85383 85384 698713 moneypunct 27 API calls 85383->85384 85385 63d013 85384->85385 85449 683bab 13 API calls 85448->85449 85450 63e3b7 85449->85450 85451 63e3fa 85450->85451 85452 63e3be 85450->85452 85453 683faf 79 API calls 85451->85453 85628 63de80 85452->85628 85455 63e400 85453->85455 85457 63e446 85455->85457 85458 63e4bf 85455->85458 86287 6838db 85505->86287 85507 636d80 85507->85187 85629 63deb1 85628->85629 85636 63df26 85628->85636 85630 63e047 85636->85630 85645 63df4e 85636->85645 86288 6838e8 86287->86288 86289 6838a6 InitializeCriticalSectionEx 86288->86289 86290 6838c4 InitializeSRWLock 86288->86290 86289->85507 86290->85507 86295 6234b8 86294->86295 86296 62348d codecvt 86294->86296 86295->86296 86372 6233ed 28 API calls 2 library calls 86295->86372 86296->85222 86372->86296 86377 629bb0 125 API calls 86376->86377 86378 6248ad 86377->86378 86379 629940 164 API calls 86378->86379 86380 6248ba 86379->86380 86381 621b84 79 API calls 86380->86381 86382 6248d5 86381->86382 86383 624190 5 API calls 86382->86383 86384 6248e3 86383->86384 86385 62136c 163 API calls 86384->86385 86389->85351 86391 641858 86390->86391 86392 62be30 78 API calls 86391->86392 86393 6418c7 86392->86393 86393->85356 86396->85347 88609 62e310 ConvertStringSecurityDescriptorToSecurityDescriptorW 88578->88609 88581 698760 27 API calls 88584 629cc1 88581->88584 88582 62a048 std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 88583 698367 __ehhandler$?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 88582->88583 88585 629c11 InitOnceComplete 88583->88585 88587 64d900 27 API calls 88584->88587 88607 629e24 codecvt 88584->88607 88585->84591 88585->84593 88586 62a072 88588 69d60f 11 API calls 88586->88588 88592 629cec 88587->88592 88589 62a077 88588->88589 88590 698713 moneypunct 27 API calls 88593 629eec std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 88590->88593 88591 64d900 27 API calls 88600 629f7e 88591->88600 88594 64d900 27 API calls 88592->88594 88593->88586 88593->88591 88595 629d4c 88594->88595 88596 683b8a __Mtx_init_in_situ 2 API calls 88595->88596 88597 629dd9 88596->88597 88630 631130 88597->88630 88599 629def 88601 62a06d Concurrency::cancel_current_task 88599->88601 88602 629e74 88599->88602 88603 629e9b 88599->88603 88599->88607 88600->88582 88600->88586 88601->88586 88602->88601 88604 629e7f 88602->88604 88606 698713 moneypunct 27 API calls 88603->88606 88603->88607 88605 698713 moneypunct 27 API calls 88604->88605 88605->88607 88606->88607 88607->88586 88607->88590 88610 62e37d 88609->88610 88617 62e376 std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 88609->88617 88611 62deb0 96 API calls 88610->88611 88612 62e3d9 88611->88612 88614 62e3e8 __cftof 88612->88614 88618 62e3dd 88612->88618 88613 698367 __ehhandler$?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 88615 629ca2 88613->88615 88616 62e425 GetModuleFileNameW 88614->88616 88615->88581 88615->88600 88619 62e443 88616->88619 88624 62e54f std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 88616->88624 88617->88613 88618->88617 88620 62e62e 88618->88620 88651 62daa0 29 API calls 4 library calls 88619->88651 88622 69d60f 11 API calls 88620->88622 88625 62e633 88622->88625 88623 62e454 88623->88624 88626 62dc20 96 API calls 88623->88626 88624->88618 88624->88620 88627 62e49d std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 88626->88627 88627->88624 88628 62e629 88627->88628 88629 69d60f 11 API calls 88628->88629 88629->88620 88652 633d80 88630->88652 88634 631183 88635 6313d8 88634->88635 88636 63119d 88634->88636 88680 6234d0 21 API calls collate 88635->88680 88638 6240e8 28 API calls 88636->88638 88640 6311bc 88638->88640 88639 69d60f 11 API calls 88641 6313e2 88639->88641 88676 633640 28 API calls codecvt 88640->88676 88643 6311cc 88677 633590 28 API calls codecvt 88643->88677 88645 6311df 88678 62f310 28 API calls 3 library calls 88645->88678 88647 6311f5 88679 633590 28 API calls codecvt 88647->88679 88649 631208 std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 88649->88639 88650 6313b9 std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 88649->88650 88650->88599 88651->88623 88681 69a3a0 88652->88681 88654 633de7 WTSGetActiveConsoleSessionId 88655 633e15 88654->88655 88656 633e0b OutputDebugStringW 88654->88656 88655->88656 88660 633e3e 88655->88660 88663 633e57 codecvt std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 88656->88663 88658 698367 __ehhandler$?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 88659 631172 88658->88659 88675 633fd0 70 API calls 2 library calls 88659->88675 88661 633f81 OutputDebugStringW 88660->88661 88662 633e4a 88660->88662 88661->88663 88662->88663 88664 633fc0 88662->88664 88668 633e90 88662->88668 88663->88658 88683 6234d0 21 API calls collate 88664->88683 88666 633fc5 88669 69d60f 11 API calls 88666->88669 88667 633fca Concurrency::cancel_current_task 88668->88667 88670 633ee7 88668->88670 88671 633f0e 88668->88671 88669->88667 88670->88667 88672 698713 moneypunct 27 API calls 88670->88672 88673 698713 moneypunct 27 API calls 88671->88673 88674 633ef8 codecvt 88671->88674 88672->88674 88673->88674 88674->88663 88674->88666 88675->88634 88676->88643 88677->88645 88678->88647 88679->88649 88682 69a3b8 88681->88682 88682->88654 88682->88682 88684->84609 88685->84611 88686->84613 88687->84604 88689 6280f9 88688->88689 88703 628185 std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 88688->88703 88707 627f60 88689->88707 88692 624300 5 API calls 88693 628109 88692->88693 88719 6281d0 28 API calls 5 library calls 88693->88719 88695 628119 88696 6289b0 27 API calls 88695->88696 88697 628130 88696->88697 88698 624300 5 API calls 88697->88698 88699 62813e 88698->88699 88720 628730 75 API calls 2 library calls 88699->88720 88701 62814b 88702 624300 5 API calls 88701->88702 88704 628156 88702->88704 88703->84617 88704->88703 88705 69d60f 11 API calls 88704->88705 88706 6281c5 88705->88706 88708 627faa 88707->88708 88718 628076 88707->88718 88721 683cd6 88708->88721 88709 698367 __ehhandler$?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 88711 62809e 88709->88711 88711->88692 88712 627faf std::_Stofx_v2 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 88724 629620 76 API calls 2 library calls 88712->88724 88714 628036 88725 628530 75 API calls 2 library calls 88714->88725 88716 62806b 88717 624300 5 API calls 88716->88717 88717->88718 88718->88709 88719->88695 88720->88701 88726 686d6a 88721->88726 88724->88714 88725->88716 88727 686d7b GetSystemTimePreciseAsFileTime 88726->88727 88728 686d87 GetSystemTimeAsFileTime 88726->88728 88729 683ce4 88727->88729 88728->88729 88729->88712 88733 6ae8ba 88732->88733 88734 6ae8a8 88732->88734 88744 6ae741 88733->88744 88760 699543 GetModuleHandleW 88734->88760 88737 6ae8ad 88737->88733 88761 6ae940 GetModuleHandleExW 88737->88761 88739 698c15 88739->84089 88745 6ae74d ___scrt_is_nonwritable_in_current_image 88744->88745 88767 6acd41 EnterCriticalSection 88745->88767 88747 6ae757 88768 6ae7ad 88747->88768 88749 6ae764 88772 6ae782 88749->88772 88752 6ae8fe 88793 6b7cf2 GetPEB 88752->88793 88755 6ae92d 88758 6ae940 std::locale::_Setgloballocale 3 API calls 88755->88758 88756 6ae90d GetPEB 88756->88755 88757 6ae91d GetCurrentProcess TerminateProcess 88756->88757 88757->88755 88759 6ae935 ExitProcess 88758->88759 88760->88737 88762 6ae95f GetProcAddress 88761->88762 88763 6ae982 88761->88763 88766 6ae974 88762->88766 88764 6ae988 FreeLibrary 88763->88764 88765 6ae8b9 88763->88765 88764->88765 88765->88733 88766->88763 88767->88747 88769 6ae7b9 ___scrt_is_nonwritable_in_current_image 88768->88769 88770 6ae81a std::locale::_Setgloballocale 88769->88770 88775 6af40b 88769->88775 88770->88749 88792 6acd91 LeaveCriticalSection 88772->88792 88774 6ae770 88774->88739 88774->88752 88778 6af13c 88775->88778 88779 6af148 ___scrt_is_nonwritable_in_current_image 88778->88779 88786 6acd41 EnterCriticalSection 88779->88786 88781 6af156 88787 6af31b 88781->88787 88785 6af174 88785->88770 88786->88781 88788 6af163 88787->88788 88789 6af33a 88787->88789 88791 6af18b LeaveCriticalSection std::_Lockit::~_Lockit 88788->88791 88789->88788 88790 6b2098 _free 14 API calls 88789->88790 88790->88788 88791->88785 88792->88774 88794 6b7d0c 88793->88794 88796 6ae908 88793->88796 88797 6b42b4 5 API calls _unexpected 88794->88797 88796->88755 88796->88756 88797->88796 88798 6814c6 88799 6814d0 88798->88799 88800 68293c ___delayLoadHelper2@8 16 API calls 88799->88800 88801 6814dd 88800->88801 88802 63928d 88841 638fb0 CoCreateGuid 88802->88841 88804 639293 88805 639297 88804->88805 88808 6392e9 88804->88808 88806 629bb0 125 API calls 88805->88806 88807 63929c 88806->88807 88809 629940 164 API calls 88807->88809 88810 639307 88808->88810 88816 639366 88808->88816 88811 6392ac 88809->88811 88812 629bb0 125 API calls 88810->88812 88813 621b84 79 API calls 88811->88813 88814 63930c 88812->88814 88815 6392c8 88813->88815 88817 629940 164 API calls 88814->88817 88880 621be0 76 API calls 88815->88880 88820 6392e0 std::ios_base::_Ios_base_dtor codecvt 88816->88820 88821 629bb0 125 API calls 88816->88821 88822 63931c 88817->88822 88819 6392d8 88823 62b8a0 163 API calls 88819->88823 88831 698367 __ehhandler$?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 88820->88831 88824 63937e 88821->88824 88825 621b84 79 API calls 88822->88825 88823->88820 88826 629940 164 API calls 88824->88826 88827 639338 88825->88827 88828 63938e 88826->88828 88881 621be0 76 API calls 88827->88881 88832 621b84 79 API calls 88828->88832 88830 639348 88833 624190 5 API calls 88830->88833 88834 63944c 88831->88834 88835 6393aa 88832->88835 88836 639358 88833->88836 88837 629ab0 76 API calls 88835->88837 88839 62b8a0 163 API calls 88836->88839 88838 6393ba 88837->88838 88840 62b8a0 163 API calls 88838->88840 88839->88820 88840->88820 88842 638fd6 StringFromCLSID 88841->88842 88843 639155 88841->88843 88842->88843 88845 638fee 88842->88845 88844 698367 __ehhandler$?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 88843->88844 88846 639163 88844->88846 88845->88843 88847 638ffe 88845->88847 88846->88804 88848 639169 88847->88848 88854 639050 88847->88854 88864 639020 codecvt std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 88847->88864 88882 6234d0 21 API calls collate 88848->88882 88850 63916e 88852 69d60f 11 API calls 88850->88852 88851 639134 CoTaskMemFree 88858 698367 __ehhandler$?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 88851->88858 88853 639173 Concurrency::cancel_current_task 88852->88853 88855 639180 88853->88855 88854->88853 88856 6390a6 88854->88856 88857 6390cd 88854->88857 88861 64d900 27 API calls 88855->88861 88856->88853 88863 698713 moneypunct 27 API calls 88856->88863 88859 6390b7 codecvt 88857->88859 88862 698713 moneypunct 27 API calls 88857->88862 88860 63914f 88858->88860 88859->88850 88859->88864 88860->88804 88865 6391cd __cftof 88861->88865 88862->88859 88863->88859 88864->88851 88866 629bb0 125 API calls 88865->88866 88867 639213 88866->88867 88868 629940 164 API calls 88867->88868 88869 639223 88868->88869 88870 621b84 79 API calls 88869->88870 88871 63923f 88870->88871 88872 629ab0 76 API calls 88871->88872 88873 63924f 88872->88873 88874 624190 5 API calls 88873->88874 88875 63925f 88874->88875 88876 62b8a0 163 API calls 88875->88876 88877 639267 std::ios_base::_Ios_base_dtor 88876->88877 88878 698367 __ehhandler$?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 88877->88878 88879 63944c 88878->88879 88879->88804 88880->88819 88881->88830 88883 6b61fa 88884 6b6206 ___scrt_is_nonwritable_in_current_image 88883->88884 88885 6b620c 88884->88885 88886 6b6223 88884->88886 88887 69d73d std::_Stodx_v2 14 API calls 88885->88887 88894 6a582c EnterCriticalSection 88886->88894 88892 6b6211 __wsopen_s 88887->88892 88889 6b6233 88895 6b627a 88889->88895 88891 6b623f 88914 6b6270 LeaveCriticalSection ___scrt_uninitialize_crt 88891->88914 88894->88889 88896 6b6288 88895->88896 88897 6b629f 88895->88897 88899 69d73d std::_Stodx_v2 14 API calls 88896->88899 88898 6b2e1c std::locale::_Setgloballocale 14 API calls 88897->88898 88900 6b62a9 88898->88900 88901 6b628d __wsopen_s 88899->88901 88915 6b6972 88900->88915 88901->88891 88904 6b638c 88906 6b639a 88904->88906 88910 6b6365 88904->88910 88905 6b6337 88908 6b6351 88905->88908 88905->88910 88907 69d73d std::_Stodx_v2 14 API calls 88906->88907 88913 6b62ee __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 88907->88913 88918 6b65bd 24 API calls 4 library calls 88908->88918 88910->88913 88919 6b63fe 18 API calls 2 library calls 88910->88919 88911 6b635d 88911->88913 88913->88891 88914->88892 88920 6b67ea 88915->88920 88917 6b62c4 88917->88904 88917->88905 88917->88913 88918->88911 88919->88913 88921 6b67f6 ___scrt_is_nonwritable_in_current_image 88920->88921 88922 6b67fe 88921->88922 88926 6b6816 88921->88926 88944 69d72a 14 API calls __dosmaperr 88922->88944 88924 6b68c7 88947 69d72a 14 API calls __dosmaperr 88924->88947 88925 6b6803 88928 69d73d std::_Stodx_v2 14 API calls 88925->88928 88926->88924 88929 6b684b 88926->88929 88934 6b680b __wsopen_s 88928->88934 88943 6bace1 EnterCriticalSection 88929->88943 88930 6b68cc 88932 69d73d std::_Stodx_v2 14 API calls 88930->88932 88932->88934 88933 6b6851 88935 6b688a 88933->88935 88936 6b6875 88933->88936 88934->88917 88938 6b68f6 __wsopen_s 16 API calls 88935->88938 88937 69d73d std::_Stodx_v2 14 API calls 88936->88937 88939 6b687a 88937->88939 88940 6b6885 88938->88940 88945 69d72a 14 API calls __dosmaperr 88939->88945 88946 6b68bf LeaveCriticalSection __wsopen_s 88940->88946 88943->88933 88944->88925 88945->88940 88946->88934 88947->88930 88948 6a22d9 88949 6a22e9 88948->88949 88950 6a22fc 88948->88950 88952 69d73d std::_Stodx_v2 14 API calls 88949->88952 88951 6a230e 88950->88951 88958 6a2321 88950->88958 88953 69d73d std::_Stodx_v2 14 API calls 88951->88953 88974 6a22ee __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z __wsopen_s __allrem 88952->88974 88953->88974 88954 6a2341 88956 69d73d std::_Stodx_v2 14 API calls 88954->88956 88955 6a2352 88975 6b3ead 88955->88975 88956->88974 88958->88954 88958->88955 88961 6a2369 88962 6a255d 88961->88962 88982 6b349f 14 API calls 2 library calls 88961->88982 88963 69d62c __Getcoll 11 API calls 88962->88963 88965 6a2567 88963->88965 88966 6a237b 88966->88962 88983 6b34cb 88966->88983 88968 6a238d 88968->88962 88969 6a2396 88968->88969 88970 6a241b 88969->88970 88971 6a23b7 88969->88971 88970->88974 88989 6b3f0a 25 API calls 2 library calls 88970->88989 88971->88974 88988 6b3f0a 25 API calls 2 library calls 88971->88988 88976 6b3eb9 ___scrt_is_nonwritable_in_current_image 88975->88976 88977 6a2357 88976->88977 88990 6acd41 EnterCriticalSection 88976->88990 88981 6b3473 14 API calls 2 library calls 88977->88981 88979 6b3eca 88991 6b3f01 LeaveCriticalSection std::_Lockit::~_Lockit 88979->88991 88981->88961 88982->88966 88984 6b34ec 88983->88984 88985 6b34d7 88983->88985 88984->88968 88986 69d73d std::_Stodx_v2 14 API calls 88985->88986 88987 6b34dc __wsopen_s 88986->88987 88987->88968 88988->88974 88989->88974 88990->88979 88991->88977 88992 64ea50 88995 64ed10 88992->88995 88993 64ea63 88996 64ed39 88995->88996 88997 64ed1a 88995->88997 88996->88993 88997->88996 88998 64ed22 RegSetValueExW 88997->88998 88998->88993 89005 64ecd0 89006 64ece7 lstrlenW 89005->89006 89007 64ecde 89005->89007 89009 64ed10 RegSetValueExW 89006->89009 89008 64ed07 89009->89008 89010 64df10 RegCreateKeyExW 89011 64df52 89010->89011 89012 674d93 89013 674d14 89012->89013 89014 68293c ___delayLoadHelper2@8 16 API calls 89013->89014 89014->89013 89015 64e590 89016 64e5a5 89015->89016 89017 64e59a 89015->89017 89020 64e8c0 RegQueryValueExW 89016->89020 89018 64e5bf 89020->89018 89021 637156 89022 698713 moneypunct 27 API calls 89021->89022 89023 63715c codecvt 89022->89023 89024 6371bf 89023->89024 89034 63722a 89023->89034 89025 629bb0 125 API calls 89024->89025 89026 6371c4 89025->89026 89027 629940 164 API calls 89026->89027 89028 6371d4 89027->89028 89031 621b84 79 API calls 89028->89031 89029 637df1 89280 6234d0 21 API calls collate 89029->89280 89033 6371f0 89031->89033 89036 629ab0 76 API calls 89033->89036 89034->89029 89037 6372b4 89034->89037 89038 6372db 89034->89038 89049 63725f codecvt 89034->89049 89040 637200 89036->89040 89039 637dfc Concurrency::cancel_current_task 89037->89039 89045 698713 moneypunct 27 API calls 89037->89045 89041 698713 moneypunct 27 API calls 89038->89041 89038->89049 89042 637e01 89039->89042 89043 621c50 76 API calls 89040->89043 89041->89049 89046 69d60f 11 API calls 89042->89046 89047 63720e 89043->89047 89044 637348 89048 629bb0 125 API calls 89044->89048 89045->89049 89050 637e06 89046->89050 89265 638f20 76 API calls 89047->89265 89052 63734d 89048->89052 89049->89042 89049->89044 89061 6373b3 89049->89061 89055 629bb0 125 API calls 89050->89055 89054 629940 164 API calls 89052->89054 89053 637219 89056 62b8a0 163 API calls 89053->89056 89057 63735d 89054->89057 89058 637e5c 89055->89058 89082 637221 std::ios_base::_Ios_base_dtor __Mtx_unlock std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 89056->89082 89059 621b84 79 API calls 89057->89059 89062 629940 164 API calls 89058->89062 89060 637379 89059->89060 89266 621be0 76 API calls 89060->89266 89061->89029 89064 637443 89061->89064 89065 63746a 89061->89065 89078 6373ee codecvt 89061->89078 89066 637e6c 89062->89066 89064->89039 89072 698713 moneypunct 27 API calls 89064->89072 89073 698713 moneypunct 27 API calls 89065->89073 89065->89078 89068 621b84 79 API calls 89066->89068 89067 637389 89069 621c50 76 API calls 89067->89069 89074 637e88 89068->89074 89075 637397 89069->89075 89070 637542 89070->89029 89076 6376d8 89070->89076 89102 6375d6 89070->89102 89103 6375ff 89070->89103 89118 63757f codecvt 89070->89118 89071 6374d7 89077 629bb0 125 API calls 89071->89077 89072->89078 89073->89078 89281 621be0 76 API calls 89074->89281 89267 638f20 76 API calls 89075->89267 89076->89029 89095 63786e 89076->89095 89105 637795 89076->89105 89106 63776c 89076->89106 89128 637715 codecvt 89076->89128 89081 6374dc 89077->89081 89078->89042 89078->89070 89078->89071 89086 629940 164 API calls 89081->89086 89087 698367 __ehhandler$?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 89082->89087 89083 637e98 89084 62b8a0 163 API calls 89083->89084 89097 637ea3 std::ios_base::_Ios_base_dtor 89084->89097 89085 6373a2 89088 62b8a0 163 API calls 89085->89088 89089 6374ec 89086->89089 89090 637dea 89087->89090 89088->89082 89092 621b84 79 API calls 89089->89092 89091 637d49 89208 644b40 89091->89208 89093 637508 89092->89093 89268 621be0 76 API calls 89093->89268 89095->89029 89113 637905 89095->89113 89114 63792e 89095->89114 89115 637a07 89095->89115 89141 6378ae codecvt 89095->89141 89096 637b9d 89096->89029 89096->89091 89104 637c00 89096->89104 89152 637bde codecvt 89096->89152 89101 698367 __ehhandler$?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 89097->89101 89099 637d63 89207 63e380 224 API calls 89099->89207 89100 637518 89107 621c50 76 API calls 89100->89107 89108 6385c6 89101->89108 89102->89039 89109 698713 moneypunct 27 API calls 89102->89109 89110 698713 moneypunct 27 API calls 89103->89110 89103->89118 89126 637c35 89104->89126 89127 637c5c 89104->89127 89122 698713 moneypunct 27 API calls 89105->89122 89105->89128 89106->89039 89119 698713 moneypunct 27 API calls 89106->89119 89111 637526 89107->89111 89109->89118 89110->89118 89269 638f20 76 API calls 89111->89269 89112 63766d 89121 629bb0 125 API calls 89112->89121 89113->89039 89131 698713 moneypunct 27 API calls 89113->89131 89133 698713 moneypunct 27 API calls 89114->89133 89114->89141 89115->89029 89115->89096 89116 637ac2 89115->89116 89117 637a9b 89115->89117 89143 637a44 codecvt 89115->89143 89136 698713 moneypunct 27 API calls 89116->89136 89116->89143 89117->89039 89134 698713 moneypunct 27 API calls 89117->89134 89118->89042 89118->89076 89118->89112 89119->89128 89130 637672 89121->89130 89122->89128 89123 637d74 89123->89042 89123->89082 89124 637803 89132 629bb0 125 API calls 89124->89132 89125 63799c 89135 629bb0 125 API calls 89125->89135 89126->89039 89137 637c40 89126->89137 89147 698713 moneypunct 27 API calls 89127->89147 89127->89152 89128->89042 89128->89095 89128->89124 89129 637531 89139 62b8a0 163 API calls 89129->89139 89140 629940 164 API calls 89130->89140 89131->89141 89142 637808 89132->89142 89133->89141 89134->89143 89144 6379a1 89135->89144 89136->89143 89145 698713 moneypunct 27 API calls 89137->89145 89138 637b32 89146 629bb0 125 API calls 89138->89146 89139->89082 89148 637682 89140->89148 89141->89042 89141->89115 89141->89125 89150 629940 164 API calls 89142->89150 89143->89042 89143->89096 89143->89138 89151 629940 164 API calls 89144->89151 89145->89152 89153 637b37 89146->89153 89147->89152 89154 621b84 79 API calls 89148->89154 89149 637ccc 89155 629bb0 125 API calls 89149->89155 89156 637818 89150->89156 89157 6379b1 89151->89157 89152->89042 89152->89091 89152->89149 89158 629940 164 API calls 89153->89158 89159 63769e 89154->89159 89160 637cd1 89155->89160 89161 621b84 79 API calls 89156->89161 89163 621b84 79 API calls 89157->89163 89164 637b47 89158->89164 89270 621be0 76 API calls 89159->89270 89166 629940 164 API calls 89160->89166 89162 637834 89161->89162 89272 621be0 76 API calls 89162->89272 89168 6379cd 89163->89168 89169 621b84 79 API calls 89164->89169 89171 637ce1 89166->89171 89274 621be0 76 API calls 89168->89274 89175 637b63 89169->89175 89170 6376ae 89176 621c50 76 API calls 89170->89176 89172 621b84 79 API calls 89171->89172 89177 637cfd 89172->89177 89173 637844 89178 621c50 76 API calls 89173->89178 89276 621be0 76 API calls 89175->89276 89181 6376bc 89176->89181 89278 621be0 76 API calls 89177->89278 89183 637852 89178->89183 89179 6379dd 89184 621c50 76 API calls 89179->89184 89271 638f20 76 API calls 89181->89271 89273 638f20 76 API calls 89183->89273 89189 6379eb 89184->89189 89185 637b73 89190 621c50 76 API calls 89185->89190 89187 637d0d 89192 621c50 76 API calls 89187->89192 89275 638f20 76 API calls 89189->89275 89195 637b81 89190->89195 89191 6376c7 89196 62b8a0 163 API calls 89191->89196 89197 637d1b 89192->89197 89193 63785d 89198 62b8a0 163 API calls 89193->89198 89277 638f20 76 API calls 89195->89277 89196->89082 89279 638f20 76 API calls 89197->89279 89198->89082 89199 6379f6 89202 62b8a0 163 API calls 89199->89202 89202->89082 89203 637b8c 89205 62b8a0 163 API calls 89203->89205 89204 637d26 89206 62b8a0 163 API calls 89204->89206 89205->89082 89206->89082 89207->89123 89282 6452d0 89208->89282 89210 644b83 89211 698713 moneypunct 27 API calls 89210->89211 89212 644c08 89211->89212 89358 646340 89212->89358 89214 644eba 89215 641b40 29 API calls 89214->89215 89223 644ec9 std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 89215->89223 89217 646360 27 API calls 89232 644d1a 89217->89232 89218 644f98 89222 644fc2 89218->89222 89364 642f20 29 API calls 3 library calls 89218->89364 89220 644c8a 89220->89232 89361 646c80 29 API calls moneypunct 89220->89361 89224 64517d 89222->89224 89225 64502e 89222->89225 89237 64500e codecvt 89222->89237 89223->89218 89226 645187 89223->89226 89363 6277a9 5 API calls collate 89223->89363 89365 6234d0 21 API calls collate 89224->89365 89234 645062 89225->89234 89235 64508b 89225->89235 89229 69d60f 11 API calls 89226->89229 89231 64518c 89229->89231 89230 645182 Concurrency::cancel_current_task 89230->89226 89241 629bb0 125 API calls 89231->89241 89232->89214 89232->89217 89236 698713 moneypunct 27 API calls 89232->89236 89238 6a594f _Yarn 15 API calls 89232->89238 89362 646640 27 API calls 3 library calls 89232->89362 89233 69e960 ___vcrt_freefls@4 14 API calls 89250 6450d8 std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 89233->89250 89234->89230 89239 64506d 89234->89239 89235->89237 89240 698713 moneypunct 27 API calls 89235->89240 89236->89232 89237->89233 89238->89232 89242 698713 moneypunct 27 API calls 89239->89242 89240->89237 89243 6451cb 89241->89243 89244 645073 89242->89244 89245 629940 164 API calls 89243->89245 89244->89226 89244->89237 89246 6451db 89245->89246 89248 621b84 79 API calls 89246->89248 89247 69e960 ___vcrt_freefls@4 14 API calls 89249 64513b std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 89247->89249 89251 6451f7 89248->89251 89256 69e960 ___vcrt_freefls@4 14 API calls 89249->89256 89252 69e960 ___vcrt_freefls@4 14 API calls 89250->89252 89254 64510c std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 89250->89254 89366 621be0 76 API calls 89251->89366 89252->89250 89254->89247 89255 645207 89258 62b8a0 163 API calls 89255->89258 89257 64514d std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 89256->89257 89259 698367 __ehhandler$?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 89257->89259 89262 64520f std::ios_base::_Ios_base_dtor std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 89258->89262 89260 645177 89259->89260 89260->89099 89261 6452a8 std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 89261->89099 89262->89261 89263 69d60f 11 API calls 89262->89263 89264 6452cb 89263->89264 89265->89053 89266->89067 89267->89085 89268->89100 89269->89129 89270->89170 89271->89191 89272->89173 89273->89193 89274->89179 89275->89199 89276->89185 89277->89203 89278->89187 89279->89204 89281->89083 89283 64571d 89282->89283 89367 646440 89283->89367 89285 64575a GetModuleHandleW 89287 645816 89285->89287 89288 646440 27 API calls 89287->89288 89289 645885 89288->89289 89377 6465c0 89289->89377 89291 64588c 89292 646440 27 API calls 89291->89292 89293 64595c 89292->89293 89294 646440 27 API calls 89293->89294 89295 645ae8 89294->89295 89317 645b83 std::ios_base::_Ios_base_dtor std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 89295->89317 89382 6211f3 29 API calls 2 library calls 89295->89382 89297 645bdb 89299 645be6 89297->89299 89303 645cfc std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 89297->89303 89298 646440 27 API calls 89306 645cc5 89298->89306 89300 629bb0 125 API calls 89299->89300 89302 645beb 89300->89302 89301 646440 27 API calls 89304 645d62 89301->89304 89305 629940 164 API calls 89302->89305 89303->89301 89304->89317 89384 63aad0 28 API calls 4 library calls 89304->89384 89307 645bfb 89305->89307 89308 645de7 89306->89308 89309 645e30 89306->89309 89319 645cd3 codecvt 89306->89319 89313 621b84 79 API calls 89307->89313 89310 646085 Concurrency::cancel_current_task 89308->89310 89311 645df2 89308->89311 89315 698713 moneypunct 27 API calls 89309->89315 89309->89319 89318 64608a 89310->89318 89314 698713 moneypunct 27 API calls 89311->89314 89316 645c17 89313->89316 89314->89319 89315->89319 89383 621be0 76 API calls 89316->89383 89317->89298 89321 69d60f 11 API calls 89318->89321 89319->89318 89325 645ebc std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 89319->89325 89322 64608f 89321->89322 89324 69d60f 11 API calls 89322->89324 89323 645c27 89326 62b8a0 163 API calls 89323->89326 89335 646094 std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 89324->89335 89327 646440 27 API calls 89325->89327 89339 645f73 std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 89325->89339 89326->89317 89331 645f2f 89327->89331 89328 645f82 GetModuleHandleW 89329 645f95 GetProcAddress 89328->89329 89330 645fc1 89328->89330 89329->89330 89332 645fa7 GetCurrentProcess 89329->89332 89337 646440 27 API calls 89330->89337 89333 645f45 89331->89333 89385 63aad0 28 API calls 4 library calls 89331->89385 89332->89330 89333->89322 89333->89328 89333->89339 89350 646166 std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 89335->89350 89390 6467b0 12 API calls std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 89335->89390 89340 646022 89337->89340 89338 6460f4 89346 64610e SysFreeString 89338->89346 89347 64611b std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 89338->89347 89339->89328 89386 6236db 27 API calls collate 89340->89386 89341 69d60f 11 API calls 89343 6461d9 89341->89343 89344 6461b4 std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 89344->89210 89345 64602a 89387 62372a 5 API calls collate 89345->89387 89346->89347 89348 646159 SysFreeString 89347->89348 89347->89350 89348->89350 89350->89341 89350->89344 89351 646032 89388 62372a 5 API calls collate 89351->89388 89353 64603a 89389 62372a 5 API calls collate 89353->89389 89355 646042 89356 698367 __ehhandler$?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 89355->89356 89357 646059 89356->89357 89357->89210 89359 698367 __ehhandler$?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 89358->89359 89360 646355 89359->89360 89360->89220 89361->89220 89362->89232 89363->89223 89364->89222 89366->89255 89368 646496 89367->89368 89369 6464fd 89368->89369 89370 6465af 89368->89370 89376 6464e8 89368->89376 89371 698713 moneypunct 27 API calls 89369->89371 89392 629b40 27 API calls 2 library calls 89370->89392 89374 646515 89371->89374 89373 6465b4 89391 646bb0 11 API calls std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 89374->89391 89376->89285 89378 6465ef std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 89377->89378 89379 6465cc 89377->89379 89378->89291 89379->89378 89380 69d60f 11 API calls 89379->89380 89381 646639 89380->89381 89382->89297 89383->89323 89384->89317 89385->89333 89386->89345 89387->89351 89388->89353 89389->89355 89390->89338 89391->89376 89392->89373 89393 6b5192 89394 6b2e1c std::locale::_Setgloballocale 14 API calls 89393->89394 89395 6b51a0 89394->89395 89396 6b51af 89395->89396 89397 6b51ce 89395->89397 89400 69d73d std::_Stodx_v2 14 API calls 89396->89400 89398 6b51e9 89397->89398 89399 6b51dc 89397->89399 89407 6b51fc 89398->89407 89426 6b555a 16 API calls __wsopen_s 89398->89426 89401 69d73d std::_Stodx_v2 14 API calls 89399->89401 89404 6b51b4 89400->89404 89401->89404 89403 6b527b 89415 6b53c0 89403->89415 89406 6bec2a __wsopen_s 14 API calls 89408 6b526e 89406->89408 89407->89403 89407->89404 89407->89406 89407->89408 89408->89403 89410 6b55f5 89408->89410 89411 6b2174 __cftoe 15 API calls 89410->89411 89412 6b5610 89411->89412 89413 6b2098 _free 14 API calls 89412->89413 89414 6b561a 89413->89414 89414->89403 89416 6b2e1c std::locale::_Setgloballocale 14 API calls 89415->89416 89417 6b53cf 89416->89417 89418 6b5472 89417->89418 89419 6b53e2 89417->89419 89420 6b5ee6 __wsopen_s 68 API calls 89418->89420 89421 6b53ff 89419->89421 89424 6b5423 89419->89424 89423 6b540c 89420->89423 89422 6b5ee6 __wsopen_s 68 API calls 89421->89422 89422->89423 89423->89404 89424->89423 89425 6b6972 18 API calls 89424->89425 89425->89423 89426->89407 89427 645318 89428 6988fa 6 API calls 89427->89428 89429 645322 89428->89429 89431 698713 moneypunct 27 API calls 89429->89431 89527 64571a 89429->89527 89430 646440 27 API calls 89432 64575a GetModuleHandleW 89430->89432 89433 64535e 89431->89433 89437 645816 89432->89437 89544 644a40 89433->89544 89436 6453a7 89438 644a40 33 API calls 89436->89438 89441 646440 27 API calls 89437->89441 89439 6453ba 89438->89439 89440 644a40 33 API calls 89439->89440 89442 6453cb 89440->89442 89443 645885 89441->89443 89551 6461f0 29 API calls 3 library calls 89442->89551 89445 6465c0 11 API calls 89443->89445 89447 64588c 89445->89447 89446 6453e9 89449 644a40 33 API calls 89446->89449 89448 646440 27 API calls 89447->89448 89456 64595c 89448->89456 89450 645486 89449->89450 89451 644a40 33 API calls 89450->89451 89452 645499 89451->89452 89453 644a40 33 API calls 89452->89453 89454 6454aa 89453->89454 89552 6461f0 29 API calls 3 library calls 89454->89552 89459 646440 27 API calls 89456->89459 89457 6454c8 89458 644a40 33 API calls 89457->89458 89460 645565 89458->89460 89467 645ae8 89459->89467 89461 644a40 33 API calls 89460->89461 89462 645578 89461->89462 89463 644a40 33 API calls 89462->89463 89464 645589 89463->89464 89553 6461f0 29 API calls 3 library calls 89464->89553 89466 6455a7 89472 644a40 33 API calls 89466->89472 89508 645b83 std::ios_base::_Ios_base_dtor std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 89467->89508 89557 6211f3 29 API calls 2 library calls 89467->89557 89469 645bdb 89471 645be6 89469->89471 89478 645cfc std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 89469->89478 89470 646440 27 API calls 89481 645cc5 89470->89481 89473 629bb0 125 API calls 89471->89473 89474 64564e 89472->89474 89476 645beb 89473->89476 89477 644a40 33 API calls 89474->89477 89475 646440 27 API calls 89479 645d62 89475->89479 89480 629940 164 API calls 89476->89480 89482 645661 89477->89482 89478->89475 89479->89508 89559 63aad0 28 API calls 4 library calls 89479->89559 89483 645bfb 89480->89483 89484 645de7 89481->89484 89485 645e30 89481->89485 89497 645cd3 codecvt 89481->89497 89486 644a40 33 API calls 89482->89486 89491 621b84 79 API calls 89483->89491 89487 646085 Concurrency::cancel_current_task 89484->89487 89488 645df2 89484->89488 89494 698713 moneypunct 27 API calls 89485->89494 89485->89497 89489 645672 89486->89489 89496 64608a 89487->89496 89492 698713 moneypunct 27 API calls 89488->89492 89554 6461f0 29 API calls 3 library calls 89489->89554 89495 645c17 89491->89495 89492->89497 89494->89497 89558 621be0 76 API calls 89495->89558 89500 69d60f 11 API calls 89496->89500 89497->89496 89504 645ebc std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 89497->89504 89498 645690 89507 698713 moneypunct 27 API calls 89498->89507 89501 64608f 89500->89501 89503 69d60f 11 API calls 89501->89503 89502 645c27 89505 62b8a0 163 API calls 89502->89505 89518 646094 std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 89503->89518 89506 646440 27 API calls 89504->89506 89524 645f73 std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 89504->89524 89505->89508 89512 645f2f 89506->89512 89513 6456d2 89507->89513 89508->89470 89509 645f82 GetModuleHandleW 89510 645f95 GetProcAddress 89509->89510 89511 645fc1 89509->89511 89510->89511 89514 645fa7 GetCurrentProcess 89510->89514 89521 646440 27 API calls 89511->89521 89515 645f45 89512->89515 89560 63aad0 28 API calls 4 library calls 89512->89560 89555 6985bf 17 API calls 89513->89555 89514->89511 89515->89501 89515->89509 89515->89524 89536 646166 std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 89518->89536 89565 6467b0 12 API calls std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 89518->89565 89520 645710 89556 6988b0 EnterCriticalSection LeaveCriticalSection RtlWakeAllConditionVariable SetEvent ResetEvent 89520->89556 89525 646022 89521->89525 89522 6460f4 89532 64610e SysFreeString 89522->89532 89533 64611b std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 89522->89533 89524->89509 89561 6236db 27 API calls collate 89525->89561 89526 69d60f 11 API calls 89529 6461d9 89526->89529 89527->89430 89530 6461b4 std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 89531 64602a 89562 62372a 5 API calls collate 89531->89562 89532->89533 89534 646159 SysFreeString 89533->89534 89533->89536 89534->89536 89536->89526 89536->89530 89537 646032 89563 62372a 5 API calls collate 89537->89563 89539 64603a 89564 62372a 5 API calls collate 89539->89564 89541 646042 89542 698367 __ehhandler$?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 89541->89542 89543 646059 89542->89543 89545 698713 moneypunct 27 API calls 89544->89545 89546 644a6e 89545->89546 89548 644aa5 _com_issue_error 89546->89548 89566 699900 89546->89566 89549 644afc SysFreeString 89548->89549 89550 644ab8 std::_Fac_tidy_reg_t::~_Fac_tidy_reg_t 89548->89550 89549->89550 89550->89436 89551->89446 89552->89457 89553->89466 89554->89498 89555->89520 89556->89527 89557->89469 89558->89502 89559->89508 89560->89515 89561->89531 89562->89537 89563->89539 89564->89541 89565->89522 89567 699960 89566->89567 89585 69993d 89566->89585 89570 69997f MultiByteToWideChar 89567->89570 89573 699a33 _com_issue_error 89567->89573 89568 698367 __ehhandler$?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z 5 API calls 89569 69995a 89568->89569 89569->89548 89571 69999c 89570->89571 89572 699a47 GetLastError 89570->89572 89574 6a594f _Yarn 15 API calls 89571->89574 89576 6999ae __Strxfrm 89571->89576 89575 699a51 _com_issue_error 89572->89575 89573->89572 89574->89576 89577 699a70 GetLastError 89575->89577 89579 69e960 ___vcrt_freefls@4 14 API calls 89575->89579 89576->89573 89578 6999fa MultiByteToWideChar 89576->89578 89586 699a7a _com_issue_error 89577->89586 89578->89575 89580 699a0e SysAllocString 89578->89580 89581 699a6d 89579->89581 89582 699a25 89580->89582 89583 699a1f 89580->89583 89581->89577 89582->89573 89582->89585 89584 69e960 ___vcrt_freefls@4 14 API calls 89583->89584 89584->89582 89585->89568 89586->89548 89590 674cfa 89591 674c79 89590->89591 89591->89590 89592 68293c ___delayLoadHelper2@8 16 API calls 89591->89592 89592->89591

                                                                                                                                                                Executed Functions

                                                                                                                                                                Function 00653AC0 Relevance: 75.4, APIs: 3, Strings: 39, Instructions: 1934COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • std::locale::_Init.LIBCPMT ref: 00653CE8
                                                                                                                                                                  • Part of subcall function 00683084: __EH_prolog3.LIBCMT ref: 0068308B
                                                                                                                                                                  • Part of subcall function 00683084: std::_Lockit::_Lockit.LIBCPMT ref: 00683096
                                                                                                                                                                  • Part of subcall function 00683084: std::locale::_Setgloballocale.LIBCPMT ref: 006830B1
                                                                                                                                                                  • Part of subcall function 00683084: std::_Lockit::~_Lockit.LIBCPMT ref: 00683107
                                                                                                                                                                • std::locale::_Init.LIBCPMT ref: 00654934
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00654CD5
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::locale::_$InitLockitstd::_$H_prolog3Ios_base_dtorLockit::_Lockit::~_Setgloballocalestd::ios_base::_
                                                                                                                                                                • String ID: $+n$$+n$2$Command "%s" failed$Couldn't find the ReturnCode attribute of EXIT command$EXIT$EXIT_UPDATE$EXIT_XML$Exit update command triggered. Exiting...$Malformed XML, no UPDATEARRAY element$NWebAdvisor::NXmlUpdater::CUpdater::Process$NWebAdvisor::NXmlUpdater::Hound::End$NWebAdvisor::NXmlUpdater::Hound::ExitResult$NWebAdvisor::NXmlUpdater::Hound::Start$PRECONDITION$PRECONDITIONARRAY$Precondition "%s" evaluated to false$Precondition "%s" evaluated to true$ReturnCode$TAG$UPDATE$UPDATEARRAY$UPDATECOMMANDS$Unable to convert ReturnCode into int$Unable to substitute the return code$XML precondition array returned false due to sniffer actions$XML precondition array returned true due to sniffer actions$XML precondition array with tag %s returned false$XML precondition array with tag %s returned false due to sniffer actions$XML precondition array with tag %s returned true due to sniffer actions$XML precondition failed - no Type specified$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\Hound.h$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\xmlUpdater.cpp$false$true$unknown$*n$*n$+n
                                                                                                                                                                • API String ID: 3544396713-2343054741
                                                                                                                                                                • Opcode ID: d904a0f76bee5159a422a500ded9c4a964e73487d01b79ea9f6c542f4dfb826f
                                                                                                                                                                • Instruction ID: 5fa9bf5ec30ae18aa3775525041fd3af95bbb856e7a03149ecc59531f5948a42
                                                                                                                                                                • Opcode Fuzzy Hash: d904a0f76bee5159a422a500ded9c4a964e73487d01b79ea9f6c542f4dfb826f
                                                                                                                                                                • Instruction Fuzzy Hash: 5F138A71D012699FDB20DF64CC59BDDBBB6AF05304F1442D9E809AB291DB74AE88CF90
                                                                                                                                                                Function 0063F110 Relevance: 75.3, APIs: 21, Strings: 21, Instructions: 1782COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0063F268
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0063F307
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0063F37E
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0063F8B0
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0063FBBD
                                                                                                                                                                  • Part of subcall function 00629BB0: InitOnceBeginInitialize.KERNEL32(007180C4,00000000,D8276B9A,00000000,D8276B9A,0062A219,007180CC,?,?,?,?,?,?,0062A219,?,?), ref: 00629BE5
                                                                                                                                                                  • Part of subcall function 00629BB0: InitOnceComplete.KERNEL32(007180C4,00000000,00000000), ref: 00629C1D
                                                                                                                                                                  • Part of subcall function 00629940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00629A12
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0063FDB6
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 006400BA
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0064015F
                                                                                                                                                                • GetLastError.KERNEL32(?,00000001,?,?,00000004), ref: 006405D7
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00640614
                                                                                                                                                                • GetLastError.KERNEL32(?,00000001,?,?,00000004), ref: 0064086A
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 006408A7
                                                                                                                                                                • GetLastError.KERNEL32(?,00000001,0000018F,00000000,X-Api-Key: ,0000000B,00000000,00000000,?,?,00000004), ref: 00640A90
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00640ACD
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Ios_base_dtorstd::ios_base::_$ErrorLast$InitOnce$BeginCompleteInitialize
                                                                                                                                                                • String ID: 0Ywx4MUvRidmWf74nsIlBPIxJYIG9Nf0lSnge8SvgvY3RVy4E6gFLp3VDBcDO830QhXvfpgCb55sRtnVqKb2zUO3Vq7ko1b$AWS Adhoc Telemetry Payload = $AWS Response Code received $AdhocTelemetryAWS$Failed to convert the x_api_key string to wide$Failed to initialize buffer for AWS$HTTP add request header failed for AWS x_api_key: $HTTP connection failed for AWS: $HTTP open request failed for AWS: $HTTP receive response failed for AWS: $HTTP send request failed for AWS: $HTTP status error for AWS: $NO_REGVALUE$Querying AdhocTelemetryAWS value failed: $SOFTWARE\McAfee\WebAdvisor$X-Api-Key: $`avo$`o$`o$`o$`o
                                                                                                                                                                • API String ID: 1658547907-587215026
                                                                                                                                                                • Opcode ID: 7f7d0f2e47451fdc7ae0728e67f93fc30144ac97b0c81f5a35ee6949f057fe0e
                                                                                                                                                                • Instruction ID: 98539d030bd63ec7b94cd79747d6495b27f4058af783bd2f621966219922e84a
                                                                                                                                                                • Opcode Fuzzy Hash: 7f7d0f2e47451fdc7ae0728e67f93fc30144ac97b0c81f5a35ee6949f057fe0e
                                                                                                                                                                • Instruction Fuzzy Hash: ACF2AD709002689BEF64DF24CC99BDDB7B6AF45304F0081E8E54DAB292DB759AC8CF54
                                                                                                                                                                Function 00635870 Relevance: 60.3, APIs: 22, Strings: 12, Instructions: 780encryptionfilethreadCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 1938 635870-6358d0 GetCurrentProcessId GetCurrentThreadId call 6a594f 1941 636170-636185 call 62c900 1938->1941 1942 6358d6-635943 CreateFileW 1938->1942 1950 636187-636189 1941->1950 1951 6361a5-6361ab 1941->1951 1944 635945-635965 CreateFileW 1942->1944 1945 63596f-635973 1942->1945 1944->1945 1947 635967-63596d 1944->1947 1948 635975 1945->1948 1949 63597a-63599c CreateFileW 1945->1949 1947->1948 1948->1949 1952 635a05-635a49 call 69a920 UuidCreate 1949->1952 1953 63599e-6359c0 CreateFileW 1949->1953 1950->1951 1954 63618b-63618e 1950->1954 1957 6361be-6361c4 1951->1957 1958 6361ad-6361ba 1951->1958 1967 63620b-63621b call 62c900 1952->1967 1968 635a4f-635a5f UuidCreate 1952->1968 1953->1952 1955 6359c2-6359e4 CreateFileW 1953->1955 1954->1951 1961 636190-636194 1954->1961 1955->1952 1962 6359e6-635a03 CreateFileW 1955->1962 1959 6361d7-6361dd 1957->1959 1960 6361c6-6361d3 1957->1960 1958->1957 1964 6361f0-636206 call 698367 1959->1964 1965 6361df-6361ec 1959->1965 1960->1959 1961->1951 1966 636196-63619a 1961->1966 1962->1952 1965->1964 1966->1951 1972 63619c-6361a3 call 6369a0 1966->1972 1967->1954 1968->1967 1974 635a65-635a87 call 635790 1968->1974 1972->1951 1982 635aea-635af2 1974->1982 1983 635a89 1974->1983 1982->1967 1984 635af8-635b30 1982->1984 1985 635a90-635a96 1983->1985 2002 636207 1984->2002 2003 635b36-635b3e 1984->2003 1986 635a98-635a9d 1985->1986 1987 635a9f-635aa5 1985->1987 1989 635ad9-635ae1 call 635790 1986->1989 1990 635aa7-635aac 1987->1990 1991 635aae-635ab4 1987->1991 1998 635ae6-635ae8 1989->1998 1990->1989 1992 635ab6-635abb 1991->1992 1993 635abd-635ac3 1991->1993 1992->1989 1996 635ac5-635aca 1993->1996 1997 635acc-635ad2 1993->1997 1996->1989 1997->1982 1999 635ad4 1997->1999 1998->1982 1998->1985 1999->1989 2002->1967 2003->2002 2004 635b44-635b5c 2003->2004 2004->2002 2007 635b62-635b66 2004->2007 2007->2002 2008 635b6c-635c01 call 634cc0 2007->2008 2008->2002 2021 635c07-635c4a 2008->2021 2026 635c50-635c54 2021->2026 2027 63616c 2021->2027 2026->2027 2028 635c5a-635c74 2026->2028 2027->1941 2028->2027 2031 635c7a-635c7e 2028->2031 2031->2027 2032 635c84-635cd4 call 634cc0 2031->2032 2039 635cd7-635ce0 2032->2039 2039->2039 2040 635ce2-635d16 CryptAcquireContextW 2039->2040 2041 635d65-635d6b 2040->2041 2042 635d18-635d32 CryptCreateHash 2040->2042 2044 635d74-635d7a 2041->2044 2045 635d6d-635d6e CryptDestroyHash 2041->2045 2042->2041 2043 635d34-635d4b CryptHashData 2042->2043 2043->2041 2046 635d4d-635d5f CryptGetHashParam 2043->2046 2047 635d85-635ef5 2044->2047 2048 635d7c-635d7f CryptReleaseContext 2044->2048 2045->2044 2046->2041 2047->2027 2077 635efb-635f4e call 634cc0 2047->2077 2048->2047 2084 635f50-635f59 2077->2084 2084->2084 2085 635f5b-635f8f CryptAcquireContextW 2084->2085 2086 635f91-635fab CryptCreateHash 2085->2086 2087 635fde-635fe4 2085->2087 2086->2087 2088 635fad-635fc4 CryptHashData 2086->2088 2089 635fe6-635fe7 CryptDestroyHash 2087->2089 2090 635fed-635ff3 2087->2090 2088->2087 2091 635fc6-635fd8 CryptGetHashParam 2088->2091 2089->2090 2092 635ff5-635ff8 CryptReleaseContext 2090->2092 2093 635ffe-636166 2090->2093 2091->2087 2092->2093 2093->2027
                                                                                                                                                                APIs
                                                                                                                                                                • GetCurrentProcessId.KERNEL32 ref: 006358AA
                                                                                                                                                                • GetCurrentThreadId.KERNEL32 ref: 006358B4
                                                                                                                                                                • CreateFileW.KERNEL32(\\.\WGUARDNT,C0000000,00000000,00000000,00000003,40000000,00000000), ref: 0063593A
                                                                                                                                                                • CreateFileW.KERNEL32(\\.\Global\WGUARDNT,C0000000,00000000,00000000,00000003,40000000,00000000), ref: 0063595C
                                                                                                                                                                • CreateFileW.KERNEL32(\\.\WGUARDNT,80000000,00000000,00000000,00000003,40000000,00000000), ref: 00635991
                                                                                                                                                                • CreateFileW.KERNEL32(\\.\Global\WGUARDNT,80000000,00000000,00000000,00000003,40000000,00000000), ref: 006359B5
                                                                                                                                                                • CreateFileW.KERNEL32(\\.\WGUARDNT,C0000000,00000000,00000000,00000003,40000000,00000000), ref: 006359D9
                                                                                                                                                                • CreateFileW.KERNEL32(\\.\Global\WGUARDNT,C0000000,00000000,00000000,00000003,40000000,00000000), ref: 006359FD
                                                                                                                                                                • UuidCreate.RPCRT4(00000000), ref: 00635A41
                                                                                                                                                                • UuidCreate.RPCRT4(00000000), ref: 00635A57
                                                                                                                                                                • CryptAcquireContextW.ADVAPI32(?), ref: 00635D0E
                                                                                                                                                                • CryptCreateHash.ADVAPI32(00000010,00008003,00000000,00000000,?), ref: 00635D2A
                                                                                                                                                                • CryptHashData.ADVAPI32(?,?,00000000,00000000), ref: 00635D43
                                                                                                                                                                • CryptGetHashParam.ADVAPI32(00000000,00000002,?,?,00000000), ref: 00635D5F
                                                                                                                                                                • CryptDestroyHash.ADVAPI32(?), ref: 00635D6E
                                                                                                                                                                • CryptReleaseContext.ADVAPI32(?,00000000), ref: 00635D7F
                                                                                                                                                                • CryptAcquireContextW.ADVAPI32(?), ref: 00635F87
                                                                                                                                                                • CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,?), ref: 00635FA3
                                                                                                                                                                • CryptHashData.ADVAPI32(?,?,00000000,00000000), ref: 00635FBC
                                                                                                                                                                • CryptGetHashParam.ADVAPI32(00000000,00000002,?,?,00000000), ref: 00635FD8
                                                                                                                                                                • CryptDestroyHash.ADVAPI32(?), ref: 00635FE7
                                                                                                                                                                • CryptReleaseContext.ADVAPI32(?,00000000), ref: 00635FF8
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Crypt$Create$Hash$File$Context$AcquireCurrentDataDestroyParamReleaseUuid$ProcessThread
                                                                                                                                                                • String ID: AacControl$AacControl2$AacControl3$AacControl4$AacControl5$AacControl6$Created access handle %p$\\.\Global\WGUARDNT$\\.\WGUARDNT$accesslib policy %x:%x$al delete policy on terminate process 0x%x (%d) rule$al disable rules on terminate thread 0x%x (%d) rule
                                                                                                                                                                • API String ID: 4128897270-3926088020
                                                                                                                                                                • Opcode ID: 095fb1983a8db731265f6985c0ecce9756b5a6f591db484daba016a7887f567c
                                                                                                                                                                • Instruction ID: e3c4434e3260c3f23b82e937ecba06ea2e3dc1a5288b7b9ff0bf9a6dcbb231f4
                                                                                                                                                                • Opcode Fuzzy Hash: 095fb1983a8db731265f6985c0ecce9756b5a6f591db484daba016a7887f567c
                                                                                                                                                                • Instruction Fuzzy Hash: 25525775A053109FDB10AF24C894B6EBBE6BF88710F160559FA46AB390CB75ED01CF86
                                                                                                                                                                Function 00671840 Relevance: 60.3, APIs: 5, Strings: 29, Instructions: 754registryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RegCreateKeyExW.KERNEL32(80000002,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,-00000028,?,?,-00000028,00000000,?), ref: 00671932
                                                                                                                                                                • RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000028,?), ref: 00671DAD
                                                                                                                                                                • RegCloseKey.ADVAPI32(00000000,?,?,?,-00000028,?,?,-00000028,00000000,?), ref: 00671DD3
                                                                                                                                                                • std::locale::_Init.LIBCPMT ref: 006720C4
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Close$CreateInitstd::locale::_
                                                                                                                                                                • String ID: to $$+n$(Default)$BIN$DWORD$Error (%d) creating registry key: %s$Error (%d) setting value (%s) under registry key: %s$Key$NUM$NWebAdvisor::NXmlUpdater::CSetVariableCommand::Execute$NWebAdvisor::NXmlUpdater::SetRegistryKey$QWORD$STR$Setting variable $Unable to convert %s to hex$Unable to read key or value attribute of SETVAR command$Unable to set the variable$Unable to substitute variables for the SETVAR command$Unknown registry key type: %s$Value$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\RegistryCommand.cpp$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\SetVariableCommand.cpp$invalid stoul argument$invalid stoull argument$invalid substitutor$memcpy_s failed in NWebAdvisor::NXmlUpdater::SetRegistryKey$stoul argument out of range$stoull argument out of range$*n
                                                                                                                                                                • API String ID: 3662814871-2807193712
                                                                                                                                                                • Opcode ID: 6ab8718666632453c47af970d053636d3bb0d6945a1090b7800e472ec45abd62
                                                                                                                                                                • Instruction ID: eb64d1cc68740cb3a1bffb5ee55e44eafcaf7fdef7323db48228cc6945936d8e
                                                                                                                                                                • Opcode Fuzzy Hash: 6ab8718666632453c47af970d053636d3bb0d6945a1090b7800e472ec45abd62
                                                                                                                                                                • Instruction Fuzzy Hash: 9552E170A013099FDB20DF98CC55BDEB7B7AF05700F1481AAE8096B381D775AA45CFA5
                                                                                                                                                                Function 006817A0 Relevance: 33.6, APIs: 18, Strings: 1, Instructions: 353encryptionCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 3020 6817a0-6817e9 3021 6817eb-68181d CryptQueryObject 3020->3021 3022 68184f 3020->3022 3023 68186d-6818ae call 6814f0 3021->3023 3024 68181f-681824 3021->3024 3025 681851-68186c call 698367 3022->3025 3034 6818b0-6818bd call 66e680 3023->3034 3035 6818e4-6818ea 3023->3035 3027 68182d-681832 3024->3027 3028 681826-681827 CryptMsgClose 3024->3028 3031 681842-681848 3027->3031 3032 681834-68183f CertCloseStore 3027->3032 3028->3027 3031->3022 3036 68184a-68184b 3031->3036 3032->3031 3042 6818bf-6818c0 CryptMsgClose 3034->3042 3043 6818c6-6818cb 3034->3043 3038 6818f0-6818f6 3035->3038 3036->3022 3040 6818fc-681944 3038->3040 3041 681b40-681b4d call 66e680 3038->3041 3045 68198e-6819d5 CryptQueryObject 3040->3045 3046 681946-681951 3040->3046 3059 681b4f-681b50 CryptMsgClose 3041->3059 3060 681b52-681b57 3041->3060 3042->3043 3049 6818db-6818df 3043->3049 3050 6818cd-6818d8 CertCloseStore 3043->3050 3047 681a39-681a5c call 6814f0 3045->3047 3048 6819d7-6819dc 3045->3048 3052 681969-68198b call 698375 3046->3052 3053 681953-681961 3046->3053 3073 681ac8-681aca 3047->3073 3074 681a5e-681a60 3047->3074 3055 6819de-6819df CryptMsgClose 3048->3055 3056 6819e1-6819ec 3048->3056 3058 681ab8-681aba 3049->3058 3050->3049 3052->3045 3061 681b7c-681b81 call 69d60f 3053->3061 3062 681967 3053->3062 3055->3056 3065 6819f8-6819fe 3056->3065 3066 6819ee-6819f5 CertCloseStore 3056->3066 3068 681abc-681abd 3058->3068 3069 681ac1-681ac3 3058->3069 3059->3060 3070 681b59-681b64 CertCloseStore 3060->3070 3071 681b67 3060->3071 3062->3052 3075 681a00-681a01 3065->3075 3076 681a05-681a1a call 66e630 call 66e680 3065->3076 3066->3065 3068->3069 3069->3025 3070->3071 3071->3061 3080 681acc-681acd CryptMsgClose 3073->3080 3081 681acf-681ad4 3073->3081 3077 681a62-681a63 CryptMsgClose 3074->3077 3078 681a65-681a70 3074->3078 3075->3076 3095 681a1c-681a1d CryptMsgClose 3076->3095 3096 681a1f-681a24 3076->3096 3077->3078 3082 681a7c-681a82 3078->3082 3083 681a72-681a79 CertCloseStore 3078->3083 3080->3081 3085 681ae4-681aea 3081->3085 3086 681ad6-681ae1 CertCloseStore 3081->3086 3089 681a89-681a9e call 66e630 call 66e680 3082->3089 3090 681a84-681a85 3082->3090 3083->3082 3087 681aec-681aed 3085->3087 3088 681af1-681af7 3085->3088 3086->3085 3087->3088 3088->3038 3093 681afd-681b08 3088->3093 3107 681aa0-681aa1 CryptMsgClose 3089->3107 3108 681aa3-681aa8 3089->3108 3090->3089 3098 681b0a-681b18 3093->3098 3099 681b1c-681b3b call 698375 3093->3099 3095->3096 3100 681a30 3096->3100 3101 681a26-681a2d CertCloseStore 3096->3101 3098->3061 3103 681b1a 3098->3103 3099->3038 3100->3047 3101->3100 3103->3099 3107->3108 3109 681aaa-681ab1 CertCloseStore 3108->3109 3110 681ab4 3108->3110 3109->3110 3110->3058
                                                                                                                                                                APIs
                                                                                                                                                                • CryptQueryObject.CRYPT32(00000001, %h,00000400,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00681815
                                                                                                                                                                • CryptMsgClose.CRYPT32(00000000), ref: 00681827
                                                                                                                                                                  • Part of subcall function 006814F0: CryptMsgGetParam.CRYPT32(?,00000005,00000000,?,?), ref: 00681581
                                                                                                                                                                  • Part of subcall function 006814F0: CryptMsgGetParam.CRYPT32(?,00000006,00000000,00000000,?), ref: 006815B2
                                                                                                                                                                  • Part of subcall function 006814F0: CryptMsgGetParam.CRYPT32(?,00000006,?,00000000,?), ref: 006815DD
                                                                                                                                                                  • Part of subcall function 006814F0: CertGetSubjectCertificateFromStore.CRYPT32(?,00010001,?), ref: 00681625
                                                                                                                                                                • CertCloseStore.CRYPT32(00000000,00000001), ref: 00681837
                                                                                                                                                                • CryptMsgClose.CRYPT32(00000000), ref: 006818C0
                                                                                                                                                                • CertCloseStore.CRYPT32(00000000,00000001), ref: 006818D0
                                                                                                                                                                • CryptQueryObject.CRYPT32(00000002,?,00003FFE,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 006819CD
                                                                                                                                                                • CryptMsgClose.CRYPT32(00000000), ref: 006819DF
                                                                                                                                                                • CertCloseStore.CRYPT32(00000000,00000001), ref: 006819F1
                                                                                                                                                                • CryptMsgClose.CRYPT32(00000000), ref: 00681A1D
                                                                                                                                                                • CertCloseStore.CRYPT32(00000000,00000001), ref: 00681A29
                                                                                                                                                                • CryptMsgClose.CRYPT32(00000000), ref: 00681A63
                                                                                                                                                                • CertCloseStore.CRYPT32(00000000,00000001), ref: 00681A75
                                                                                                                                                                • CryptMsgClose.CRYPT32(00000000), ref: 00681AA1
                                                                                                                                                                • CertCloseStore.CRYPT32(00000000,00000001), ref: 00681AAD
                                                                                                                                                                • CryptMsgClose.CRYPT32(00000000), ref: 00681ACD
                                                                                                                                                                • CertCloseStore.CRYPT32(00000000,00000001), ref: 00681AD9
                                                                                                                                                                • CryptMsgClose.CRYPT32(00000000), ref: 00681B50
                                                                                                                                                                • CertCloseStore.CRYPT32(00000000,00000001), ref: 00681B5C
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Close$Crypt$CertStore$Param$ObjectQuery$CertificateFromSubject
                                                                                                                                                                • String ID: %h
                                                                                                                                                                • API String ID: 2648890560-1821812351
                                                                                                                                                                • Opcode ID: 0f0cb7e796cd6c405b96966525a2616c8a02a4dddc5d73586910e969855ecf98
                                                                                                                                                                • Instruction ID: b29befdb081c6254009c7364bc6e2d7cda0527dc72e0339343fa885a33af37bb
                                                                                                                                                                • Opcode Fuzzy Hash: 0f0cb7e796cd6c405b96966525a2616c8a02a4dddc5d73586910e969855ecf98
                                                                                                                                                                • Instruction Fuzzy Hash: 26C10C71E00249ABDF10DFA9CC85BDEBBBDAF09744F148519E504FB280EB759905CB64
                                                                                                                                                                Function 0066FFE0 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 368COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 3111 66ffe0-67002d 3112 670051-670055 3111->3112 3113 67002f-67004c call 658650 3111->3113 3115 670057-67005d 3112->3115 3116 6700ae-67010d 3112->3116 3124 670557-670571 call 698367 3113->3124 3120 670061-67006a 3115->3120 3121 67005f 3115->3121 3118 670122-670135 3116->3118 3119 67010f-67011b 3116->3119 3125 670574-670579 call 6234d0 3118->3125 3126 67013b-670145 3118->3126 3119->3118 3122 670077-67007c call 66eb20 3120->3122 3123 67006c-670073 call 6821d0 3120->3123 3121->3120 3138 67007f-670081 3122->3138 3132 670075 3123->3132 3127 670147-670149 3126->3127 3128 67014f-670187 3126->3128 3127->3128 3133 6701d3-670283 call 69a3a0 call 62e9c0 3128->3133 3134 670189-670194 3128->3134 3132->3138 3153 670287-670318 call 62e9c0 call 6238d0 * 2 call 69a920 3133->3153 3154 670285 3133->3154 3139 670196-67019b 3134->3139 3140 67019d-6701a4 3134->3140 3138->3116 3143 670083-670087 3138->3143 3142 6701a7-6701cd call 6233c3 3139->3142 3140->3142 3142->3133 3146 67008b-6700a9 call 658650 3143->3146 3147 670089 3143->3147 3146->3124 3147->3146 3163 670320-670328 3153->3163 3154->3153 3164 67033e-670355 3163->3164 3165 67032a-670331 3163->3165 3167 670357 3164->3167 3168 670359-670383 CreateProcessW 3164->3168 3165->3164 3166 670333-67033c 3165->3166 3166->3163 3166->3164 3167->3168 3169 670385-6703b5 GetLastError call 658650 3168->3169 3170 6703ba-6703ca WaitForSingleObject 3168->3170 3179 670526-67053f call 6238d0 3169->3179 3171 6703de-6703fd GetExitCodeProcess 3170->3171 3172 6703cc-6703d0 3170->3172 3176 670430-670434 3171->3176 3177 6703ff-67040b GetLastError 3171->3177 3174 6703d4-6703dc 3172->3174 3175 6703d2 3172->3175 3180 670410-67042b call 658650 3174->3180 3175->3174 3181 670436-67043a 3176->3181 3182 67046e-670477 3176->3182 3177->3180 3192 670544-67054c 3179->3192 3193 670541-670542 CloseHandle 3179->3193 3180->3179 3185 67043e-670447 DeleteFileW 3181->3185 3186 67043c 3181->3186 3183 670480-67049e 3182->3183 3183->3183 3189 6704a0-6704c4 3183->3189 3185->3182 3191 670449-67046b GetLastError call 658650 3185->3191 3186->3185 3194 6704d7-67051f call 6214a1 call 65a350 call 6238d0 * 2 3189->3194 3195 6704c6-6704d2 call 62347e 3189->3195 3191->3182 3197 670551 3192->3197 3198 67054e-67054f CloseHandle 3192->3198 3193->3192 3194->3179 3195->3194 3197->3124 3198->3197
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID: D$Failed to delete executable (%d)$Failed to get process exit code (%d)$NWebAdvisor::NXmlUpdater::CExecuteLocalCommand::ExecuteLocalCommand$Signature check failed for command %s$Unable to run %s, error (%d)$Wait for process failed for command %s$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\ExecuteLocalCommand.cpp$invalid substitutor
                                                                                                                                                                • API String ID: 0-284121414
                                                                                                                                                                • Opcode ID: 1120f8ef448e130cd4d019779e9a6b93ec5ff069c3aa76ce59c00b8adf037ebe
                                                                                                                                                                • Instruction ID: 5b4126e7860863778bd5cd965d16446b12a084214376b4421692707d1739d44b
                                                                                                                                                                • Opcode Fuzzy Hash: 1120f8ef448e130cd4d019779e9a6b93ec5ff069c3aa76ce59c00b8adf037ebe
                                                                                                                                                                • Instruction Fuzzy Hash: 18E19C70A01369DBEB24DF24CD49BEDB7B6AF54304F1082DAE40DA7291DB709A84CF61
                                                                                                                                                                Function 00635204 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 345registryCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 3384 635204-63523e RegOpenKeyExW 3385 6352e2-635311 call 69e960 GetLastError 3384->3385 3386 635244-635273 RegQueryValueExW 3384->3386 3390 63538b-6353dc 3385->3390 3388 635275-63527d 3386->3388 3389 6352ca-6352dc RegCloseKey 3386->3389 3388->3389 3392 63527f-635292 call 634c10 3388->3392 3389->3385 3389->3390 3393 6353de-6353eb OutputDebugStringW call 634f50 3390->3393 3394 6353fd-635401 3390->3394 3404 6352b4-6352c8 SetLastError RegCloseKey 3392->3404 3405 635294-63529c 3392->3405 3402 6353f0-6353f8 3393->3402 3397 635403-635449 call 69a920 * 2 call 636ae0 3394->3397 3398 63547e-635481 3394->3398 3397->3398 3434 63544b-635471 3397->3434 3400 635483-635489 3398->3400 3401 63548f-635496 3398->3401 3400->3401 3406 6355d1-6355d7 3400->3406 3401->3406 3407 63549c-6354b8 OutputDebugStringW call 634e60 3401->3407 3402->3398 3404->3385 3405->3389 3409 63529e-6352b2 call 634c10 3405->3409 3410 6355f3 3406->3410 3411 6355d9 3406->3411 3425 6355cb 3407->3425 3426 6354be-6354d8 call 634e60 3407->3426 3409->3389 3409->3404 3419 6355f5 3410->3419 3416 635703-63570a 3411->3416 3417 6355df-6355e5 3411->3417 3422 635739 3416->3422 3423 63570c-63571b LoadLibraryExW 3416->3423 3417->3416 3424 6355eb-6355f1 3417->3424 3419->3416 3427 6355fb-635606 3419->3427 3429 63573e-635743 3422->3429 3423->3429 3430 63571d-635737 GetLastError call 69e960 3423->3430 3424->3419 3425->3406 3444 6354f2-635516 call 6a594f 3426->3444 3445 6354da-6354e0 3426->3445 3432 635610-63561c call 634dc0 3427->3432 3433 635608-63560a 3427->3433 3437 635745-63574b call 69874c 3429->3437 3438 63574e-635753 3429->3438 3430->3429 3447 635622-63562a 3432->3447 3448 6356ea-6356ef 3432->3448 3433->3432 3434->3398 3437->3438 3441 635755-63575b call 69874c 3438->3441 3442 63575e-635784 call 698367 3438->3442 3441->3442 3453 635518-63551f 3444->3453 3452 6354e2-6354eb call 69e960 3445->3452 3445->3453 3447->3448 3455 635630 3447->3455 3448->3429 3456 6356f1-635701 call 69e960 3448->3456 3452->3444 3453->3427 3459 635525-63554b call 634e60 call 634cc0 3453->3459 3463 635635-635639 3455->3463 3456->3429 3476 6355c4-6355c9 3459->3476 3477 63554d-63557f call 69a920 * 2 call 636ae0 3459->3477 3467 635643-63565a 3463->3467 3468 63563b-635641 3463->3468 3467->3448 3471 635660-6356a2 call 634dc0 call 6a594f 3467->3471 3468->3463 3468->3467 3471->3448 3482 6356a4-6356e2 call 634dc0 call 634cc0 OutputDebugStringW call 69e960 3471->3482 3476->3427 3488 635584-63558d 3477->3488 3493 6356e7 3482->3493 3488->3406 3490 63558f-6355c2 3488->3490 3490->3406 3493->3448
                                                                                                                                                                APIs
                                                                                                                                                                • RegOpenKeyExW.KERNEL32(80000002,Software\McAfee\SystemCore,00000000,00020219,?), ref: 00635225
                                                                                                                                                                • RegQueryValueExW.ADVAPI32(?,szInstallDir32,00000000,?,?,?), ref: 00635265
                                                                                                                                                                • SetLastError.KERNEL32(0000006F,?,?,006FA17C), ref: 006352B6
                                                                                                                                                                • RegCloseKey.ADVAPI32(?), ref: 006352C2
                                                                                                                                                                • RegCloseKey.ADVAPI32(?), ref: 006352D0
                                                                                                                                                                • GetLastError.KERNEL32 ref: 006352F6
                                                                                                                                                                • OutputDebugStringW.KERNEL32(NCPrivateLoadAndValidateMPTDll: Looking in current directory), ref: 006353E3
                                                                                                                                                                • OutputDebugStringW.KERNEL32(NCPrivateLoadAndValidateMPTDll: Looking in EXE directory), ref: 006354A1
                                                                                                                                                                Strings
                                                                                                                                                                • NotComDllGetInterface: %ls loading %ls, WinVerifyTrust failed with %08x, xrefs: 006356B7
                                                                                                                                                                • %ls\%ls, xrefs: 00635533
                                                                                                                                                                • szInstallDir32, xrefs: 0063525F
                                                                                                                                                                • NCPrivateLoadAndValidateMPTDll: Looking in EXE directory, xrefs: 0063549C
                                                                                                                                                                • NCPrivateLoadAndValidateMPTDll: Looking in current directory, xrefs: 006353DE
                                                                                                                                                                • Software\McAfee\SystemCore, xrefs: 0063521B
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseDebugErrorLastOutputString$OpenQueryValue
                                                                                                                                                                • String ID: %ls\%ls$NCPrivateLoadAndValidateMPTDll: Looking in EXE directory$NCPrivateLoadAndValidateMPTDll: Looking in current directory$NotComDllGetInterface: %ls loading %ls, WinVerifyTrust failed with %08x$Software\McAfee\SystemCore$szInstallDir32
                                                                                                                                                                • API String ID: 901107078-3767168787
                                                                                                                                                                • Opcode ID: 16d711d41dfe8de5288626e32692931990b2b3659ad28d248342eb6d9dbacb6d
                                                                                                                                                                • Instruction ID: 4f9a7f69c31b9515c215ce41f83dbee05033bd16361fbe655d3d3a5ca059bc0d
                                                                                                                                                                • Opcode Fuzzy Hash: 16d711d41dfe8de5288626e32692931990b2b3659ad28d248342eb6d9dbacb6d
                                                                                                                                                                • Instruction Fuzzy Hash: 07D18071E006199FEF24DB64CC45BAEB7B6BF04310F0441A9E90AAB281DB75AE54CFD1
                                                                                                                                                                Function 006370D9 Relevance: 27.2, APIs: 4, Strings: 11, Instructions: 977COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00644B40: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0064521E
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00637D3D
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 00637DFC
                                                                                                                                                                • __Mtx_unlock.LIBCPMT ref: 00637DC8
                                                                                                                                                                  • Part of subcall function 00629BB0: InitOnceBeginInitialize.KERNEL32(007180C4,00000000,D8276B9A,00000000,D8276B9A,0062A219,007180CC,?,?,?,?,?,?,0062A219,?,?), ref: 00629BE5
                                                                                                                                                                  • Part of subcall function 00629BB0: InitOnceComplete.KERNEL32(007180C4,00000000,00000000), ref: 00629C1D
                                                                                                                                                                  • Part of subcall function 00629940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00629A12
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00637EBB
                                                                                                                                                                Strings
                                                                                                                                                                • Failed to add event action (, xrefs: 00637379
                                                                                                                                                                • Failed to add reserved 2 dimension (, xrefs: 00637834
                                                                                                                                                                • Failed to add reserved 1 dimension (, xrefs: 0063769E
                                                                                                                                                                • u, xrefs: 00637B57
                                                                                                                                                                • Failed to add event label (, xrefs: 00637508
                                                                                                                                                                • Service has not been initialized, xrefs: 00637E88
                                                                                                                                                                • Failed to add reserved 4 dimension (, xrefs: 00637B63
                                                                                                                                                                • Failed to add reserved 5 dimension (, xrefs: 00637CFD
                                                                                                                                                                • Failed to add reserved 3 dimension (, xrefs: 006379CD
                                                                                                                                                                • Failed to add event category (, xrefs: 006371F0
                                                                                                                                                                • z, xrefs: 00637CF1
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Ios_base_dtorstd::ios_base::_$InitOnce$BeginCompleteConcurrency::cancel_current_taskInitializeMtx_unlock
                                                                                                                                                                • String ID: Failed to add event action ($Failed to add event category ($Failed to add event label ($Failed to add reserved 1 dimension ($Failed to add reserved 2 dimension ($Failed to add reserved 3 dimension ($Failed to add reserved 4 dimension ($Failed to add reserved 5 dimension ($Service has not been initialized$u$z
                                                                                                                                                                • API String ID: 342047005-3525645681
                                                                                                                                                                • Opcode ID: 62babf129076270c4afceb54fa20b055cd0bad955df19869caabec95eaf12528
                                                                                                                                                                • Instruction ID: 14178516bb6dd14bc2d0918c62bcc94ca49777dfd924299a10ff274e924d5abe
                                                                                                                                                                • Opcode Fuzzy Hash: 62babf129076270c4afceb54fa20b055cd0bad955df19869caabec95eaf12528
                                                                                                                                                                • Instruction Fuzzy Hash: FD82E3B0604244DFDF28EF24D895BEE7BA6AF45310F10419CE8168B382DB75DA44CFA6
                                                                                                                                                                Function 00638FB0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 245COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CoCreateGuid.OLE32(?), ref: 00638FC8
                                                                                                                                                                • StringFromCLSID.OLE32(?,?), ref: 00638FE0
                                                                                                                                                                • CoTaskMemFree.OLE32(?), ref: 00639138
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 00639173
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 006393D1
                                                                                                                                                                Strings
                                                                                                                                                                • Could not create registry key , xrefs: 0063923F
                                                                                                                                                                • SOFTWARE\McAfee\WebAdvisor, xrefs: 006391FB
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Concurrency::cancel_current_taskCreateFreeFromGuidIos_base_dtorStringTaskstd::ios_base::_
                                                                                                                                                                • String ID: Could not create registry key $SOFTWARE\McAfee\WebAdvisor
                                                                                                                                                                • API String ID: 3741506170-3627174789
                                                                                                                                                                • Opcode ID: beea50e32b4631cbdd50e3794990fe97bf2ed04f835effed00604642dca5912b
                                                                                                                                                                • Instruction ID: e44314d2a1ea5450a810967deddfb4e095c13a3ace06374fd27d18571978aec6
                                                                                                                                                                • Opcode Fuzzy Hash: beea50e32b4631cbdd50e3794990fe97bf2ed04f835effed00604642dca5912b
                                                                                                                                                                • Instruction Fuzzy Hash: EE810771A002059FDB18EF64DC45BAEB7AAFF44310F10462DF91697281EB74A904CFE5
                                                                                                                                                                Function 006814F0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 215encryptionCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CryptMsgGetParam.CRYPT32(?,00000005,00000000,?,?), ref: 00681581
                                                                                                                                                                • CryptMsgGetParam.CRYPT32(?,00000006,00000000,00000000,?), ref: 006815B2
                                                                                                                                                                • CryptMsgGetParam.CRYPT32(?,00000006,?,00000000,?), ref: 006815DD
                                                                                                                                                                • CertGetSubjectCertificateFromStore.CRYPT32(?,00010001,?), ref: 00681625
                                                                                                                                                                • CertFreeCRLContext.CRYPT32(?), ref: 0068175E
                                                                                                                                                                  • Part of subcall function 0069E960: _free.LIBCMT ref: 0069E973
                                                                                                                                                                • CertFreeCRLContext.CRYPT32(?), ref: 00681738
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CertCryptParam$ContextFree$CertificateFromStoreSubject_free
                                                                                                                                                                • String ID: %h
                                                                                                                                                                • API String ID: 4059466977-1821812351
                                                                                                                                                                • Opcode ID: 33708dc1f6fc593e965c29d267aec62d8c04f1d9232802dcf3faaf85d9a56562
                                                                                                                                                                • Instruction ID: b60c878c60edb5be8021c7630c0e2ff287b339d3a6b9437b198747148eed1961
                                                                                                                                                                • Opcode Fuzzy Hash: 33708dc1f6fc593e965c29d267aec62d8c04f1d9232802dcf3faaf85d9a56562
                                                                                                                                                                • Instruction Fuzzy Hash: FF818D71800249DFDF20EF64D841BEEBBB9FF0A344F144219E955AB352E7319A06CBA1
                                                                                                                                                                Function 00624C8E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 73processCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetCurrentProcessId.KERNEL32 ref: 00624CA6
                                                                                                                                                                • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00624CB8
                                                                                                                                                                • Process32FirstW.KERNEL32(00000000,?), ref: 00624CD3
                                                                                                                                                                • Process32NextW.KERNEL32(00000000,0000022C), ref: 00624CE9
                                                                                                                                                                • FindCloseChangeNotification.KERNEL32(00000000), ref: 00624CFA
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Process32$ChangeCloseCreateCurrentFindFirstNextNotificationProcessSnapshotToolhelp32
                                                                                                                                                                • String ID: saBSI.exe
                                                                                                                                                                • API String ID: 1594840063-3955546181
                                                                                                                                                                • Opcode ID: 015c08b76e06a2b851919f434182b480bff4afe8bc75b4498b190b92d8116e64
                                                                                                                                                                • Instruction ID: 76715e01477f8c5f084254ef7e46dc39db18bdfea06ededa087caaeab705cad8
                                                                                                                                                                • Opcode Fuzzy Hash: 015c08b76e06a2b851919f434182b480bff4afe8bc75b4498b190b92d8116e64
                                                                                                                                                                • Instruction Fuzzy Hash: 772108316067109FC320BB64BC89AAF7797EF85320F150629F915C72D0EB359905CEA6
                                                                                                                                                                Function 00634F50 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 150COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetCurrentDirectoryW.KERNEL32(00000000,00000000,D8276B9A), ref: 00634FB5
                                                                                                                                                                • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00634FDF
                                                                                                                                                                • GetLastError.KERNEL32 ref: 00634FF2
                                                                                                                                                                • GetLastError.KERNEL32 ref: 0063500B
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CurrentDirectoryErrorLast
                                                                                                                                                                • String ID: %ls\%ls
                                                                                                                                                                • API String ID: 152501406-2125769799
                                                                                                                                                                • Opcode ID: 9ed0b226986e986c9dd6f7f4deb71da28c6f5b9a4c59acae5866578f1228397f
                                                                                                                                                                • Instruction ID: ab6ebdf8f9b748abc98f8a49221eaa012187f8fdef3e2d2868318319a3602fc6
                                                                                                                                                                • Opcode Fuzzy Hash: 9ed0b226986e986c9dd6f7f4deb71da28c6f5b9a4c59acae5866578f1228397f
                                                                                                                                                                • Instruction Fuzzy Hash: 32418271E006159BDB14DFB5CC45BAFB7BAAF44700F24413EE806EB281EB3699058BE5
                                                                                                                                                                Function 006AE8FE Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetCurrentProcess.KERNEL32(?,?,006AE8FD,00000002,00000002,?,00000002), ref: 006AE920
                                                                                                                                                                • TerminateProcess.KERNEL32(00000000,?,006AE8FD,00000002,00000002,?,00000002), ref: 006AE927
                                                                                                                                                                • ExitProcess.KERNEL32 ref: 006AE939
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Process$CurrentExitTerminate
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1703294689-0
                                                                                                                                                                • Opcode ID: 63f555ada4b7bad312bf7fa5e06aef76325ebf666d944aba5a21342a21e59e65
                                                                                                                                                                • Instruction ID: 230b4c1112597ce9570cd9eb01361ea2904705419eb1bdcb6c31b6a2d108dd2e
                                                                                                                                                                • Opcode Fuzzy Hash: 63f555ada4b7bad312bf7fa5e06aef76325ebf666d944aba5a21342a21e59e65
                                                                                                                                                                • Instruction Fuzzy Hash: 27E04631401208AFCF513F64DD08A893F2BEB41341F04441AF8088A231CB37EE91CB51
                                                                                                                                                                Function 00645318 Relevance: 72.7, APIs: 12, Strings: 29, Instructions: 928COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 1169 645318-64532c call 6988fa 1172 645332-6453a2 call 698713 call 644a40 1169->1172 1173 64571d-645b7a call 646440 GetModuleHandleW call 646440 call 6465c0 call 646440 * 2 call 639180 1169->1173 1181 6453a7-64571a call 644a40 * 2 call 6461f0 call 6985d4 call 644a40 * 3 call 6461f0 call 6985d4 call 644a40 * 3 call 6461f0 call 6985d4 call 644a40 * 3 call 6461f0 call 6985d4 call 698713 call 6985bf call 6988b0 1172->1181 1230 645b7f-645b81 1173->1230 1231 645b7a call 639180 1173->1231 1181->1173 1234 645bc4-645be0 call 6211f3 1230->1234 1235 645b83-645b8d 1230->1235 1231->1230 1245 645be6-645c59 call 629bb0 call 629940 call 621b84 call 621be0 call 62b8a0 call 682bfd 1234->1245 1246 645cfc-645d06 1234->1246 1238 645b93-645ba5 1235->1238 1239 645c8d-645ccd call 646440 1235->1239 1243 645c83-645c8a call 698375 1238->1243 1244 645bab-645bbf 1238->1244 1253 645db3-645dc0 1239->1253 1254 645cd3-645cd8 1239->1254 1243->1239 1244->1243 1245->1239 1349 645c5b-645c6d 1245->1349 1256 645d08-645d1a 1246->1256 1257 645d3a-645d67 call 646440 1246->1257 1262 645dc2-645dc7 1253->1262 1263 645dc9-645dce 1253->1263 1260 645cdc-645cf7 call 69a3a0 1254->1260 1261 645cda 1254->1261 1265 645d30-645d37 call 698375 1256->1265 1266 645d1c-645d2a 1256->1266 1274 645d78-645d82 1257->1274 1275 645d69-645d73 call 63aad0 1257->1275 1289 645e8e-645e98 1260->1289 1261->1260 1271 645dd1-645de5 1262->1271 1263->1271 1265->1257 1266->1265 1278 645de7-645dec 1271->1278 1279 645e30-645e32 1271->1279 1274->1239 1288 645d88-645d94 1274->1288 1275->1274 1281 646085 Concurrency::cancel_current_task 1278->1281 1282 645df2-645dfd call 698713 1278->1282 1284 645e64-645e86 1279->1284 1285 645e34-645e62 call 698713 1279->1285 1298 64608a call 69d60f 1281->1298 1282->1298 1310 645e03-645e2e 1282->1310 1294 645e8c 1284->1294 1285->1294 1288->1243 1295 645d9a-645dae 1288->1295 1296 645ec6-645ee7 call 639980 1289->1296 1297 645e9a-645ea6 1289->1297 1294->1289 1295->1243 1309 645eec-645eee 1296->1309 1305 645ebc-645ec3 call 698375 1297->1305 1306 645ea8-645eb6 1297->1306 1308 64608f-6460aa call 69d60f 1298->1308 1305->1296 1306->1298 1306->1305 1327 6460ac-6460b6 1308->1327 1328 6460d8-6460fc call 6467b0 1308->1328 1315 645ef4-645f34 call 646440 1309->1315 1316 645f7f 1309->1316 1310->1294 1335 645f45-645f4f 1315->1335 1336 645f36-645f40 call 63aad0 1315->1336 1324 645f82-645f93 GetModuleHandleW 1316->1324 1325 645f95-645fa5 GetProcAddress 1324->1325 1326 645fd1 1324->1326 1325->1326 1332 645fa7-645fc5 GetCurrentProcess 1325->1332 1338 645fd3-64605c call 646440 call 6236db call 62372a * 3 call 698367 1326->1338 1333 6460ce-6460d5 call 698375 1327->1333 1334 6460b8-6460c6 1327->1334 1358 646144-646149 1328->1358 1359 6460fe-646106 1328->1359 1332->1326 1381 645fc7-645fcb 1332->1381 1333->1328 1341 6461d4-6461d9 call 69d60f 1334->1341 1342 6460cc 1334->1342 1335->1324 1346 645f51-645f5d 1335->1346 1336->1335 1342->1333 1354 645f73-645f7d call 698375 1346->1354 1355 645f5f-645f6d 1346->1355 1349->1243 1350 645c6f-645c7d 1349->1350 1350->1243 1354->1324 1355->1308 1355->1354 1360 64618f-646197 1358->1360 1361 64614b-646151 1358->1361 1366 64613d 1359->1366 1367 646108-64610c 1359->1367 1368 6461c0-6461d3 1360->1368 1369 646199-6461a2 1360->1369 1371 646153-646157 1361->1371 1372 646188 1361->1372 1366->1358 1375 64610e-646115 SysFreeString 1367->1375 1376 64611b-646120 1367->1376 1379 6461a4-6461b2 1369->1379 1380 6461b6-6461bd call 698375 1369->1380 1382 646166-64616b 1371->1382 1383 646159-646160 SysFreeString 1371->1383 1372->1360 1375->1376 1377 646132-64613a call 698375 1376->1377 1378 646122-64612b call 69874c 1376->1378 1377->1366 1378->1377 1379->1341 1387 6461b4 1379->1387 1380->1368 1381->1326 1388 645fcd-645fcf 1381->1388 1390 64617d-646185 call 698375 1382->1390 1391 64616d-646176 call 69874c 1382->1391 1383->1382 1387->1380 1388->1338 1390->1372 1391->1390
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 006988FA: EnterCriticalSection.KERNEL32(0071742C,?,?,?,0063402B,0071827C,D8276B9A,?,00631171,?), ref: 00698905
                                                                                                                                                                  • Part of subcall function 006988FA: LeaveCriticalSection.KERNEL32(0071742C,?,?,?,0063402B,0071827C,D8276B9A,?,00631171,?), ref: 00698942
                                                                                                                                                                  • Part of subcall function 00644A40: _com_issue_error.COMSUPP ref: 00644AD2
                                                                                                                                                                  • Part of subcall function 00644A40: SysFreeString.OLEAUT32(-00000001), ref: 00644AFD
                                                                                                                                                                  • Part of subcall function 006461F0: Concurrency::cancel_current_task.LIBCPMT ref: 006462BF
                                                                                                                                                                  • Part of subcall function 006988B0: EnterCriticalSection.KERNEL32(0071742C,?,?,00634086,0071827C,006D68E0,?), ref: 006988BA
                                                                                                                                                                  • Part of subcall function 006988B0: LeaveCriticalSection.KERNEL32(0071742C,?,?,00634086,0071827C,006D68E0,?), ref: 006988ED
                                                                                                                                                                  • Part of subcall function 006988B0: RtlWakeAllConditionVariable.NTDLL ref: 00698964
                                                                                                                                                                • GetModuleHandleW.KERNEL32(kernel32.dll,00000000,D8276B9A,?,?), ref: 006457B4
                                                                                                                                                                • FindResourceW.KERNEL32(00000000,00000001,00000010), ref: 006457C5
                                                                                                                                                                • LoadResource.KERNEL32(00000000,00000000), ref: 006457D1
                                                                                                                                                                • LockResource.KERNEL32(00000000), ref: 006457DC
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 00646067
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 00646085
                                                                                                                                                                • SysFreeString.OLEAUT32 ref: 0064610F
                                                                                                                                                                • SysFreeString.OLEAUT32(00000000), ref: 0064615A
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CriticalSection$Concurrency::cancel_current_taskFreeResourceString$EnterLeave$ConditionFindHandleLoadLockModuleVariableWake_com_issue_error
                                                                                                                                                                • String ID: (error)$)$0.0.0.0$0o$4.1.1.865$4o$EstimatedRunTime$Failed to convert wuuid to string$IsWow64Process$NO_REGKEY$PCSystemTypeEx$PowerState$PredictFailure$Root\CIMV2$Time$UUID$UUID$Version$ery)$kState$kernel32$kernel32.dll$orm$root\wmi$select EstimatedRunTime from Win32_Battery$select PCSystemTypeEx from Win32_ComputerSystem$select PowerState from Win32_ComputerSystem$select PredictFailure from MSStorageDriver_FailurePredictStatus$t
                                                                                                                                                                • API String ID: 2830066208-1306179857
                                                                                                                                                                • Opcode ID: b284f3a812c6e747ad2071587d2151a5b196d0ea632cbed7dd294defc38d2f83
                                                                                                                                                                • Instruction ID: f9a9d077c4235448a9c38a6338090f2289664a236d4ececcc79e7198885ace59
                                                                                                                                                                • Opcode Fuzzy Hash: b284f3a812c6e747ad2071587d2151a5b196d0ea632cbed7dd294defc38d2f83
                                                                                                                                                                • Instruction Fuzzy Hash: 81821470900348DFEB14DFA8D8497ADBBB3AF45300F24825CE415AB7D2DB799A84CB56
                                                                                                                                                                Function 00624E1F Relevance: 65.5, APIs: 9, Strings: 28, Instructions: 767COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 1406 624e1f-624e73 call 64d6d0 1409 624ec6-624ede call 624d63 1406->1409 1410 624e75-624ec1 call 629bb0 call 629940 call 621b84 call 621be0 call 62136c 1406->1410 1415 624ee0-624f34 call 629bb0 call 629940 call 621b84 call 621be0 call 62136c 1409->1415 1416 624f39-624f46 CoInitializeEx 1409->1416 1410->1409 1451 6258da-6258e1 1415->1451 1420 624f48-624f4b 1416->1420 1421 624f4d-624f51 call 625a4f 1416->1421 1420->1421 1422 624f56-624f7c call 698760 1420->1422 1421->1422 1432 624f86 1422->1432 1433 624f7e-624f84 1422->1433 1436 624f88-624f99 call 625d57 1432->1436 1433->1436 1443 624ff1-625008 call 698760 1436->1443 1444 624f9b-624fec call 629bb0 call 629940 call 621b84 call 621be0 call 62136c 1436->1444 1454 625012 1443->1454 1455 62500a-625010 1443->1455 1478 6258ba-6258bf 1444->1478 1452 6258e3-6258e9 CloseHandle 1451->1452 1453 6258ef-625913 call 698367 1451->1453 1452->1453 1458 625014-62502c call 625db6 1454->1458 1455->1458 1466 62507b-6250cc call 69a920 call 698760 1458->1466 1467 62502e-625076 call 629bb0 call 629940 call 621b84 call 621be0 call 62136c 1458->1467 1483 6250d8 1466->1483 1484 6250ce-6250d6 call 636bd0 1466->1484 1507 6258ab-6258b3 1467->1507 1481 6258c1 call 627d21 1478->1481 1482 6258c6-6258d2 call 6259c2 1478->1482 1481->1482 1482->1451 1496 6258d4 CoUninitialize 1482->1496 1485 6250da-6250f0 call 625e16 1483->1485 1484->1485 1497 6250f2-62513e call 629bb0 call 629940 call 621b84 call 621be0 call 62136c 1485->1497 1498 625143-625154 1485->1498 1496->1451 1533 625897-62589c 1497->1533 1500 625156 1498->1500 1501 62515a-625176 1498->1501 1500->1501 1504 625178 1501->1504 1505 62517c-625194 1501->1505 1504->1505 1508 625196 1505->1508 1509 62519a-6251a9 call 653670 1505->1509 1507->1478 1510 6258b5 call 627d21 1507->1510 1508->1509 1517 6251f7-625233 CommandLineToArgvW 1509->1517 1518 6251ab-6251f2 call 629bb0 call 629940 call 621b84 call 621be0 1509->1518 1510->1478 1530 625284-6252b0 call 69a920 GetModuleFileNameW 1517->1530 1531 625235-625282 call 629bb0 call 629940 call 621b84 call 621be0 GetLastError 1517->1531 1548 625310-625318 call 62136c 1518->1548 1545 6252b2-6252fc call 629bb0 call 629940 call 621b84 call 621be0 GetLastError 1530->1545 1546 62531d-625367 call 62d730 call 69a920 GetLongPathNameW 1530->1546 1570 6252ff-62530a call 626140 1531->1570 1535 6258a3-6258a6 call 625946 1533->1535 1536 62589e call 627d21 1533->1536 1535->1507 1536->1535 1545->1570 1563 625419-625520 call 62171d * 2 call 655b70 call 623899 * 2 call 6249d2 call 62171d * 2 call 655b70 call 623899 * 2 call 6249d2 1546->1563 1564 62536d-625416 call 629bb0 call 629940 call 621b84 call 621be0 GetLastError call 626140 call 6261b0 call 624190 call 62136c call 69ea46 1546->1564 1548->1533 1615 625522-625591 call 624a04 call 62171d call 655b70 call 623899 * 2 1563->1615 1616 625596-6255a8 call 6249d2 1563->1616 1564->1563 1570->1548 1615->1616 1622 625611-62564f call 624a4a 1616->1622 1623 6255aa-62560c call 62171d * 2 call 655b70 call 623899 * 2 1616->1623 1640 625651-625693 call 629bb0 call 629940 call 621b84 call 626220 call 62136c 1622->1640 1641 625698-6256a9 call 624b92 1622->1641 1623->1622 1640->1641 1650 62571b-625729 call 623a88 1641->1650 1651 6256ab-625716 call 629bb0 call 629940 call 621b84 call 621be0 1641->1651 1655 62572e-625733 1650->1655 1691 625887-62588c call 62136c 1651->1691 1658 625739-62573b 1655->1658 1659 6257ed-625802 call 627d7c 1655->1659 1663 625746-62575b call 627d7c 1658->1663 1664 62573d-625740 1658->1664 1672 625806-625881 call 62372a call 629bb0 call 629940 call 621b84 call 621be0 call 626290 1659->1672 1673 625804 1659->1673 1674 62575f-6257e8 call 62372a call 629bb0 call 629940 call 621b84 call 621be0 call 626290 call 62136c 1663->1674 1675 62575d 1663->1675 1664->1659 1664->1663 1672->1691 1673->1672 1700 62588f-625892 call 623899 1674->1700 1675->1674 1691->1700 1700->1533
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 0064D6D0: GetModuleHandleW.KERNEL32(kernel32.dll,00624E6C,D8276B9A), ref: 0064D6D5
                                                                                                                                                                  • Part of subcall function 0064D6D0: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 0064D6E5
                                                                                                                                                                • CoInitializeEx.OLE32(00000000,00000000,D8276B9A), ref: 00624F3E
                                                                                                                                                                • CommandLineToArgvW.SHELL32(?,?), ref: 00625226
                                                                                                                                                                • GetLastError.KERNEL32(?,00000001), ref: 00625276
                                                                                                                                                                • GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 006252A8
                                                                                                                                                                • GetLastError.KERNEL32(?,00000001), ref: 006252F3
                                                                                                                                                                • GetLongPathNameW.KERNEL32(?,?,00000104), ref: 0062535F
                                                                                                                                                                • GetLastError.KERNEL32(?,00000002), ref: 006253AE
                                                                                                                                                                • CloseHandle.KERNEL32(?,?,00000001), ref: 006258E9
                                                                                                                                                                  • Part of subcall function 00629BB0: InitOnceBeginInitialize.KERNEL32(007180C4,00000000,D8276B9A,00000000,D8276B9A,0062A219,007180CC,?,?,?,?,?,?,0062A219,?,?), ref: 00629BE5
                                                                                                                                                                  • Part of subcall function 00629BB0: InitOnceComplete.KERNEL32(007180C4,00000000,00000000), ref: 00629C1D
                                                                                                                                                                  • Part of subcall function 00629940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00629A12
                                                                                                                                                                  • Part of subcall function 0062136C: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 006213A5
                                                                                                                                                                • CoUninitialize.OLE32(?,00000001), ref: 006258D4
                                                                                                                                                                  • Part of subcall function 00636BD0: __Mtx_init_in_situ.LIBCPMT ref: 00636CC0
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorLast$HandleInitInitializeIos_base_dtorModuleNameOncestd::ios_base::_$AddressArgvBeginCloseCommandCompleteFileLineLongMtx_init_in_situPathProcUninitialize
                                                                                                                                                                • String ID: /no_self_update$/store_xml_on_disk$/xml$BSI installation success. Exit code: $BootStrapInstaller$CommandLineToArgvW failed: $Ended$FALSE$Failed$Failed to allocate memory for event sender service$Failed to create xml updater logger$Failed to create xml updater signature verifier$GetLongPathName failed ($GetModuleFileName failed: $InitSecureDllLoading failed.$Install$InvalidArguments$MAIN_XML$Process$SA/WA installation failed with exit code: $SELF_UPDATE_ALLOWED$STORE_XML_ON_DISK$SaBsi.cpp$Some command line BSI variables are invalid.$Started$TRUE$WaitForOtherBSIToExit failed$failed to initialize updater
                                                                                                                                                                • API String ID: 126520999-360321973
                                                                                                                                                                • Opcode ID: a53e5fed8c8efbcb609a4254dbe6625780aac8b805ec5ac523a9530b58898ce6
                                                                                                                                                                • Instruction ID: b9e939fe117c9e74932bafc9fcd51999875659321db5b268b4b2a4afc9f52cb1
                                                                                                                                                                • Opcode Fuzzy Hash: a53e5fed8c8efbcb609a4254dbe6625780aac8b805ec5ac523a9530b58898ce6
                                                                                                                                                                • Instruction Fuzzy Hash: AA627DB0900669DFDF14EFA4E895AED7BB6BF14304F50805DF809AB281DB709A44CFA5
                                                                                                                                                                Function 0065EFC0 Relevance: 65.5, APIs: 13, Strings: 24, Instructions: 743COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 1717 65efc0-65f053 call 6741f0 call 674430 1722 65f055-65f06b call 658650 1717->1722 1723 65f07f-65f13b call 65ea50 call 69a920 * 2 1717->1723 1726 65f070-65f07a 1722->1726 1738 65f13d-65f163 GetLastError call 65e9b0 1723->1738 1739 65f168-65f170 1723->1739 1728 65fa58-65fa83 call 674210 call 698367 1726->1728 1745 65f3cb-65f3e6 call 658650 1738->1745 1741 65f172-65f186 1739->1741 1742 65f18d-65f1ab call 674280 1739->1742 1741->1742 1748 65f1ad-65f1d3 GetLastError call 65e9b0 1742->1748 1749 65f1d8-65f209 call 674480 1742->1749 1745->1728 1748->1745 1755 65f236-65f255 call 674250 1749->1755 1756 65f20b-65f231 GetLastError call 65e9b0 1749->1756 1761 65f257-65f286 call 658650 1755->1761 1762 65f289-65f29a call 674640 1755->1762 1756->1745 1761->1762 1766 65f2f3-65f300 call 674620 1762->1766 1767 65f29c-65f2ee GetLastError call 65e9b0 call 658650 1762->1767 1775 65f302-65f324 GetLastError call 65e9b0 1766->1775 1776 65f329-65f33f call 674560 1766->1776 1767->1728 1775->1745 1782 65f341-65f384 GetLastError call 65e9b0 call 658650 1776->1782 1783 65f389-65f3a7 call 6744c0 1776->1783 1782->1728 1789 65f3a9-65f3c6 GetLastError call 65e9b0 1783->1789 1790 65f3eb-65f41a call 6a594f 1783->1790 1789->1745 1796 65f41c-65f455 call 65e9b0 call 658650 1790->1796 1797 65f45a-65f461 1790->1797 1810 65fa4f-65fa50 call 69e960 1796->1810 1799 65f463-65f48f 1797->1799 1800 65f4c2-65f4db call 6608c0 1797->1800 1802 65f495-65f49e 1799->1802 1809 65f4e0-65f501 call 6244b2 1800->1809 1802->1802 1805 65f4a0-65f4c0 call 62347e 1802->1805 1805->1809 1815 65f503-65f517 call 6238d0 1809->1815 1816 65f51d-65f523 1809->1816 1817 65fa55 1810->1817 1815->1816 1819 65f525-65f52b call 6238d0 1816->1819 1820 65f530-65f537 1816->1820 1817->1728 1819->1820 1823 65f5a0-65f5de call 660230 1820->1823 1824 65f539-65f53f 1820->1824 1831 65f657-65f669 call 6238d0 1823->1831 1832 65f5e0-65f5e6 1823->1832 1826 65f561-65f582 call 658650 1824->1826 1827 65f541-65f55f call 658650 1824->1827 1837 65f585-65f59b call 65e9b0 1826->1837 1827->1837 1847 65f66d-65f676 PathFileExistsW 1831->1847 1848 65f66b 1831->1848 1835 65f625-65f654 1832->1835 1836 65f5e8-65f5f7 1832->1836 1835->1831 1839 65f60f-65f61f call 698375 1836->1839 1840 65f5f9-65f607 1836->1840 1849 65fa44-65fa4a call 6238d0 1837->1849 1839->1835 1844 65f60d 1840->1844 1845 65fadf-65fb00 call 69d60f 1840->1845 1844->1839 1860 65fb02-65fb0a call 698375 1845->1860 1861 65fb0d-65fb11 1845->1861 1850 65f83d-65f844 1847->1850 1851 65f67c-65f68b 1847->1851 1848->1847 1849->1810 1855 65f846 1850->1855 1856 65f848-65f86a CreateFileW 1850->1856 1857 65f691-65f6a4 1851->1857 1858 65f8b8-65f8bc 1851->1858 1855->1856 1862 65f870-65f8b3 call 65e9b0 call 658650 1856->1862 1863 65f8fa-65f942 call 6735a0 call 6745f0 1856->1863 1864 65fada call 6234d0 1857->1864 1865 65f6aa-65f6ae 1857->1865 1866 65f8c0-65f8f5 call 658650 call 65e9b0 1858->1866 1867 65f8be 1858->1867 1860->1861 1862->1849 1891 65f9d6-65fa1a CloseHandle call 6735f0 call 62149c 1863->1891 1892 65f948 1863->1892 1864->1845 1870 65f6b0-65f6b2 1865->1870 1871 65f6b8-65f6f2 1865->1871 1866->1849 1867->1866 1870->1871 1877 65f6f4-65f6ff 1871->1877 1878 65f739-65f7ba call 69a3a0 DeleteFileW 1871->1878 1882 65f701-65f706 1877->1882 1883 65f708-65f70f 1877->1883 1895 65f7bc 1878->1895 1896 65f7be-65f7ca call 6a65f0 1878->1896 1889 65f712-65f733 call 6233c3 1882->1889 1883->1889 1889->1878 1914 65fa24-65fa33 call 65e9b0 1891->1914 1915 65fa1c-65fa1f 1891->1915 1899 65f950-65f958 1892->1899 1895->1896 1906 65f7cc-65f7ee call 69d73d call 65e9b0 1896->1906 1907 65f82e-65f838 call 6238d0 1896->1907 1899->1891 1904 65f95a-65f973 WriteFile 1899->1904 1908 65fa86-65fad5 call 65e9b0 call 658650 CloseHandle 1904->1908 1909 65f979-65f9c9 call 65e990 call 674140 call 6745f0 1904->1909 1927 65f7f0 1906->1927 1928 65f7f2-65f829 call 658650 call 6238d0 1906->1928 1907->1850 1929 65fa3a 1908->1929 1934 65f9ce-65f9d0 1909->1934 1914->1929 1915->1914 1927->1928 1928->1849 1929->1849 1934->1891 1934->1899
                                                                                                                                                                APIs
                                                                                                                                                                • GetLastError.KERNEL32 ref: 0065F13D
                                                                                                                                                                  • Part of subcall function 00658650: std::locale::_Init.LIBCPMT ref: 0065882F
                                                                                                                                                                • CloseHandle.KERNEL32(?,?,?,?,?,00000006,00000000,?,?,?,00000000,?,?,?,00000000,00000000), ref: 0065FAC8
                                                                                                                                                                  • Part of subcall function 0069E960: _free.LIBCMT ref: 0069E973
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseErrorHandleInitLast_freestd::locale::_
                                                                                                                                                                • String ID: <$<Zn$Cache-Control: no-cache$CreateFile failed (%d)$File already exists: %s$GET$HTTP GET request failed (%d), url: %s$HTTP add request headers failed (%d), url: %s$HTTP connection failed (%d), url: %s$HTTP query content length (%d), url: %s$HTTP receive response failed (%d), url: %s$HTTP send request failed (%d), url: %s, ignore proxy flag %s$HTTP status (%d) error (%d), url: %s$NWebAdvisor::NHttp::NDownloadFile::StoreOnDisk::<lambda_2af623cb1b195cc2505e5df23daadde2>::operator ()$Unable to allocate %d bytes$Unable to extract the filename from url (%s)$Unable to open HTTP transaction$Unable to rename the old file (%d): %s$WinHttpCrackUrl failed (%d), url: %s$WriteFile failed (%d)$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\HttpsDownloadFile.cpp$empty filename$false$true
                                                                                                                                                                • API String ID: 2292809486-3613537506
                                                                                                                                                                • Opcode ID: 989ae6e68d30b7e93b3a0eb95716459bd78c2c09d61f0af62a77348eb2080dec
                                                                                                                                                                • Instruction ID: 9fd0e9d1e215d0ad819ac7db03c809b105b4e9978691de92ac662b08306daa54
                                                                                                                                                                • Opcode Fuzzy Hash: 989ae6e68d30b7e93b3a0eb95716459bd78c2c09d61f0af62a77348eb2080dec
                                                                                                                                                                • Instruction Fuzzy Hash: 7C62BFB0A40619EFDB64DF10CC45FA9B7B6BF44305F0001E9FA1967292DB71AA84CF99
                                                                                                                                                                Function 006665F0 Relevance: 38.9, APIs: 4, Strings: 18, Instructions: 416COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 2370 6665f0-666642 2371 666646-66664a 2370->2371 2372 666644 2370->2372 2373 6668c4-6668de 2371->2373 2374 666650-666662 call 621b0c 2371->2374 2372->2371 2375 6668e4-666900 call 651ac0 2373->2375 2376 666a8f-666aa3 call 6988fa 2373->2376 2374->2373 2383 666668-666690 2374->2383 2385 666902-666912 2375->2385 2386 66695a-666960 2375->2386 2376->2375 2384 666aa9-666cc3 call 6660c0 * 3 call 62347e call 6660c0 * 2 call 62347e * 4 call 666400 call 6985d4 call 6985bf call 6988b0 2376->2384 2387 666696-6666be 2383->2387 2388 666712 2383->2388 2384->2375 2393 666916-666923 2385->2393 2394 666914 2385->2394 2391 666964-6669a1 call 658650 2386->2391 2392 666962 2386->2392 2395 6666c4-6666cd 2387->2395 2390 666719-666727 2388->2390 2399 666734-66673b 2390->2399 2400 666729-66672f call 6238d0 2390->2400 2415 6669a4-6669ad 2391->2415 2392->2391 2396 666925-666927 2393->2396 2397 66692d-66694e call 621b0c 2393->2397 2394->2393 2395->2395 2402 6666cf-666710 call 62347e call 6593a0 2395->2402 2396->2397 2417 666954 2397->2417 2418 6669db-6669e4 2397->2418 2407 66673d-66677c call 658650 2399->2407 2408 6667a8-6667df call 69a920 2399->2408 2400->2399 2402->2388 2402->2390 2428 666780-666789 2407->2428 2425 6667e1-6667f5 2408->2425 2426 66681d 2408->2426 2415->2415 2422 6669af-6669b7 call 62347e 2415->2422 2417->2386 2423 6669ea-6669f6 2417->2423 2418->2386 2418->2423 2435 6669bc-6669d8 call 698367 2422->2435 2423->2386 2430 6669fc-666a1c SHGetKnownFolderPath 2423->2430 2425->2426 2431 6667f7-6667fd 2425->2431 2432 66681f-666843 GetEnvironmentVariableW 2426->2432 2428->2428 2434 66678b-6667a3 call 62347e call 6238d0 2428->2434 2436 666a54-666a8a call 6214a1 CoTaskMemFree call 6244b2 call 6238d0 2430->2436 2437 666a1e-666a22 2430->2437 2438 666800 2431->2438 2439 666845-66684a 2432->2439 2440 66686e-6668b1 GetLastError call 658650 2432->2440 2434->2435 2436->2435 2444 666a26-666a4f call 658650 call 6214a1 2437->2444 2445 666a24 2437->2445 2438->2426 2447 666802-666805 2438->2447 2439->2440 2449 66684c-666865 call 6214a1 call 6238d0 2439->2449 2462 6668b4-6668bd 2440->2462 2444->2435 2445->2444 2456 666807-66681b 2447->2456 2457 66686a-66686c 2447->2457 2449->2435 2456->2426 2456->2438 2457->2432 2462->2462 2469 6668bf 2462->2469 2469->2373
                                                                                                                                                                APIs
                                                                                                                                                                • GetEnvironmentVariableW.KERNEL32(ProgramW6432,?,00000104), ref: 0066683B
                                                                                                                                                                • GetLastError.KERNEL32 ref: 0066686E
                                                                                                                                                                • SHGetKnownFolderPath.SHELL32(?,00000000,00000000,?,?,?,?), ref: 00666A15
                                                                                                                                                                • CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000000,?,?,?,?), ref: 00666A6B
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: EnvironmentErrorFolderFreeKnownLastPathTaskVariable
                                                                                                                                                                • String ID: CSIDL_COMMON_APPDATA$CSIDL_COMMON_DOCUMENTS$CSIDL_COMMON_STARTUP$CSIDL_PROGRAM_FILES$CSIDL_PROGRAM_FILESX64$CSIDL_PROGRAM_FILESX86$CSIDL_PROGRAM_FILES_COMMON$CSIDL_SYSTEM$CSIDL_SYSTEMX86$CSIDL_WINDOWS$Error retrieving directory %s$GetEnvironmentVariable failed (%d)$NWebAdvisor::NXmlUpdater::CDirSubstitution::Substitute$ProgramFiles$ProgramW6432$Unable to get the platform$Unknown folder identifier: %s$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\DirSubstitution.cpp
                                                                                                                                                                • API String ID: 3946049928-1874136459
                                                                                                                                                                • Opcode ID: 04f44408abd2ba18c256926a3d0b3cb931f9bcff6e730813dc8f2b84accec2a6
                                                                                                                                                                • Instruction ID: 750942b60cc5d96d6e6284c0d5196455aa7abba4a61cad723f43c0a966afba91
                                                                                                                                                                • Opcode Fuzzy Hash: 04f44408abd2ba18c256926a3d0b3cb931f9bcff6e730813dc8f2b84accec2a6
                                                                                                                                                                • Instruction Fuzzy Hash: ED02D070A007A8DBDB60DF64DC49BDDB7B2AF14704F10429DE8096B281EB756A88CF64
                                                                                                                                                                Function 0065EAA0 Relevance: 37.8, APIs: 8, Strings: 17, Instructions: 326COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 2492 65eaa0-65eb46 call 6741f0 call 674430 2497 65eb4c-65ebf6 call 69a920 * 2 2492->2497 2498 65ec1b-65ec28 2492->2498 2509 65ec2d-65ec35 2497->2509 2510 65ebf8-65ec18 GetLastError call 658650 2497->2510 2499 65ef5b-65ef83 call 674210 call 698367 2498->2499 2512 65ec37-65ec4b 2509->2512 2513 65ec52-65ec6d call 674280 2509->2513 2510->2498 2512->2513 2517 65eca4-65ecd5 call 674480 2513->2517 2518 65ec6f-65ec9f GetLastError call 658650 2513->2518 2523 65ecd7-65ed07 GetLastError call 658650 2517->2523 2524 65ed0c-65ed2b call 674250 2517->2524 2518->2499 2523->2499 2529 65ed2d-65ed49 GetLastError call 658650 2524->2529 2530 65ed4c-65ed5d call 674640 2524->2530 2529->2530 2535 65eda5-65edb2 call 674620 2530->2535 2536 65ed5f-65eda0 GetLastError call 658650 2530->2536 2541 65ede5-65edfb call 674560 2535->2541 2542 65edb4-65ede0 GetLastError call 658650 2535->2542 2536->2499 2547 65ee34-65ee52 call 6744c0 2541->2547 2548 65edfd-65ee2f GetLastError call 658650 2541->2548 2542->2499 2553 65ee54-65ee83 GetLastError call 658650 2547->2553 2554 65ee88-65eea4 call 6a594f 2547->2554 2548->2499 2553->2499 2559 65eea6-65eed5 call 658650 call 69e960 2554->2559 2560 65eeda-65ef01 call 6745f0 2554->2560 2559->2499 2564 65ef06-65ef08 2560->2564 2566 65ef46-65ef58 call 69e960 2564->2566 2567 65ef0a 2564->2567 2566->2499 2570 65ef10-65ef18 2567->2570 2570->2566 2572 65ef1a-65ef22 2570->2572 2573 65ef24-65ef44 call 6745f0 2572->2573 2574 65ef86-65efb9 call 658650 call 69e960 2572->2574 2573->2566 2573->2570 2574->2499
                                                                                                                                                                APIs
                                                                                                                                                                • GetLastError.KERNEL32(D8276B9A), ref: 0065EBF9
                                                                                                                                                                • GetLastError.KERNEL32(D8276B9A,?,00000000,?), ref: 0065EC70
                                                                                                                                                                • GetLastError.KERNEL32(D8276B9A,GET,?,00000000,00000000,00000000,00000000,?,00000000,?), ref: 0065ECD8
                                                                                                                                                                  • Part of subcall function 00658650: std::locale::_Init.LIBCPMT ref: 0065882F
                                                                                                                                                                • GetLastError.KERNEL32(D8276B9A,Cache-Control: no-cache,000000FF,40000000,GET,?,00000000,00000000,00000000,00000000,?,00000000,?), ref: 0065ED2E
                                                                                                                                                                • GetLastError.KERNEL32(D8276B9A,true,00000000,00000000,Cache-Control: no-cache,000000FF,40000000,GET,?,00000000,00000000,00000000,00000000,?,00000000,?), ref: 0065ED75
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorLast$Initstd::locale::_
                                                                                                                                                                • String ID: @]e$Cache-Control: no-cache$GET$HTTP GET request failed (%d), url: %s$HTTP add request headers failed (%d), url: %s$HTTP connection failed (%d), url: %s$HTTP query content length (%d), url: %s$HTTP receive response failed (%d), url: %s$HTTP send request failed (%d), url: %s, proxy ignore flag %s$HTTP status (%d) error (%d), url: %s$NWebAdvisor::NHttp::NDownloadFile::From::<lambda_1effc98e56da47b46c9f3c737083b6c0>::operator ()$Not enough space in buffer: bufferLength(%d) Read(%d)$Unable to allocate %d bytes$WinHttpCrackUrl failed (%d), url: %s$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\HttpsDownloadFile.cpp$false$true
                                                                                                                                                                • API String ID: 1579124236-1152569559
                                                                                                                                                                • Opcode ID: 2f76bdf36cd47715a63ffaddc82836835d6271e131b76816f698ab5f11de5726
                                                                                                                                                                • Instruction ID: 66a17157331742648ee6b59501b29724a1736c998de1d9cd581d5867a4ffe6d4
                                                                                                                                                                • Opcode Fuzzy Hash: 2f76bdf36cd47715a63ffaddc82836835d6271e131b76816f698ab5f11de5726
                                                                                                                                                                • Instruction Fuzzy Hash: 76C1D7F0A41718AAEB249F10CC56FE9B776AF14708F404199FA09771C2DBB15A88CF5D
                                                                                                                                                                Function 00659400 Relevance: 37.6, APIs: 7, Strings: 14, Instructions: 871libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 2581 659400-659483 GetModuleHandleW 2582 659485-659495 GetProcAddress 2581->2582 2583 6594c2 2581->2583 2582->2583 2584 659497-6594b3 GetCurrentProcess 2582->2584 2585 6594c4-6594dc 2583->2585 2584->2583 2589 6594b5-6594bc 2584->2589 2586 6594e0-6594e9 2585->2586 2586->2586 2588 6594eb-65952f call 62347e 2586->2588 2593 659530-659539 2588->2593 2589->2583 2591 6594be-6594c0 2589->2591 2591->2585 2593->2593 2594 65953b-659567 call 62347e call 658c60 2593->2594 2599 659585-659592 2594->2599 2600 659569-659580 call 62347e 2594->2600 2602 659594-6595a9 2599->2602 2603 6595c9-6595f6 2599->2603 2600->2599 2604 6595bf-6595c6 call 698375 2602->2604 2605 6595ab-6595b9 2602->2605 2606 65962d-659674 call 6591a0 2603->2606 2607 6595f8-65960d 2603->2607 2604->2603 2605->2604 2609 65a108-65a121 call 69d60f 2605->2609 2617 659677-659680 2606->2617 2611 659623-65962a call 698375 2607->2611 2612 65960f-65961d 2607->2612 2611->2606 2612->2609 2612->2611 2617->2617 2620 659682-6596a8 call 62347e call 658c60 2617->2620 2625 6596be-6596cb 2620->2625 2626 6596aa-6596b1 2620->2626 2629 659702-65972f 2625->2629 2630 6596cd-6596e2 2625->2630 2627 6596b5-6596b9 call 62347e 2626->2627 2628 6596b3 2626->2628 2627->2625 2628->2627 2631 659766-6597c9 call 69a920 GetModuleFileNameW 2629->2631 2632 659731-659746 2629->2632 2634 6596e4-6596f2 2630->2634 2635 6596f8-6596ff call 698375 2630->2635 2644 659816-659884 call 660750 call 623f22 call 6238d0 call 69a920 GetLongPathNameW 2631->2644 2645 6597cb-6597fb GetLastError call 658650 2631->2645 2637 65975c-659763 call 698375 2632->2637 2638 659748-659756 2632->2638 2634->2635 2635->2629 2637->2631 2638->2637 2663 659886-6598e8 GetLastError call 658650 call 69ea46 2644->2663 2664 6598eb-6598f1 2644->2664 2651 659800-659809 2645->2651 2651->2651 2653 65980b-659811 2651->2653 2654 65990b-659948 call 62347e 2653->2654 2660 659950-659959 2654->2660 2660->2660 2662 65995b-659987 call 62347e call 658c60 2660->2662 2675 6599a5-6599b2 2662->2675 2676 659989-6599a0 call 62347e 2662->2676 2663->2664 2667 6598f4-6598fd 2664->2667 2667->2667 2668 6598ff-65990a 2667->2668 2668->2654 2678 6599b4-6599c9 2675->2678 2679 6599e9-659a16 2675->2679 2676->2675 2682 6599df-6599e6 call 698375 2678->2682 2683 6599cb-6599d9 2678->2683 2680 659a4d-659abf call 62347e 2679->2680 2681 659a18-659a2d 2679->2681 2692 659ac0-659ac9 2680->2692 2685 659a43-659a4a call 698375 2681->2685 2686 659a2f-659a3d 2681->2686 2682->2679 2683->2682 2685->2680 2686->2685 2692->2692 2693 659acb-659af7 call 62347e call 658c60 2692->2693 2698 659b15-659b22 2693->2698 2699 659af9-659b10 call 62347e 2693->2699 2701 659b24-659b39 2698->2701 2702 659b59-659b86 2698->2702 2699->2698 2703 659b4f-659b56 call 698375 2701->2703 2704 659b3b-659b49 2701->2704 2705 659bbd-659c2f call 62347e 2702->2705 2706 659b88-659b9d 2702->2706 2703->2702 2704->2703 2714 659c30-659c39 2705->2714 2709 659bb3-659bba call 698375 2706->2709 2710 659b9f-659bad 2706->2710 2709->2705 2710->2709 2714->2714 2716 659c3b-659c67 call 62347e call 658c60 2714->2716 2721 659c85-659c92 2716->2721 2722 659c69-659c80 call 62347e 2716->2722 2724 659c94-659ca9 2721->2724 2725 659cc9-659cf6 2721->2725 2722->2721 2728 659cbf-659cc6 call 698375 2724->2728 2729 659cab-659cb9 2724->2729 2726 659d2d-659d69 call 658f20 call 65a130 2725->2726 2727 659cf8-659d0d 2725->2727 2740 659d72-659dae call 658f60 call 65a130 2726->2740 2741 659d6b-659d6d 2726->2741 2730 659d23-659d2a call 698375 2727->2730 2731 659d0f-659d1d 2727->2731 2728->2725 2729->2728 2730->2726 2731->2730 2746 659db7-659df3 call 658ee0 call 65a130 2740->2746 2747 659db0-659db2 2740->2747 2741->2740 2752 659df5-659df7 2746->2752 2753 659dfc-659e38 call 659120 call 65a130 2746->2753 2747->2746 2752->2753 2758 659e41-659e7d call 659120 call 65a130 2753->2758 2759 659e3a-659e3c 2753->2759 2764 659e86-659ec2 call 6590e0 call 65a130 2758->2764 2765 659e7f-659e81 2758->2765 2759->2758 2770 659ec4-659ec6 2764->2770 2771 659ecb-659f07 call 659160 call 65a130 2764->2771 2765->2764 2770->2771 2776 659f10-659f4c call 659060 call 65a130 2771->2776 2777 659f09-659f0b 2771->2777 2782 659f55-659f91 call 659060 call 65a130 2776->2782 2783 659f4e-659f50 2776->2783 2777->2776 2788 659f93-659f95 2782->2788 2789 659f9a-659fd6 call 659020 call 65a130 2782->2789 2783->2782 2788->2789 2794 659fdf-65a01b call 6590a0 call 65a130 2789->2794 2795 659fd8-659fda 2789->2795 2800 65a024-65a060 call 658fa0 call 65a130 2794->2800 2801 65a01d-65a01f 2794->2801 2795->2794 2806 65a062-65a064 2800->2806 2807 65a069-65a0a5 call 658fe0 call 65a130 2800->2807 2801->2800 2806->2807 2812 65a0a7-65a0a9 2807->2812 2813 65a0ae-65a0e3 call 658ea0 call 65a130 2807->2813 2812->2813 2818 65a0e5-65a0e7 2813->2818 2819 65a0ec-65a107 call 698367 2813->2819 2818->2819
                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleHandleW.KERNEL32(kernel32,D8276B9A,?), ref: 0065947B
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 0065948B
                                                                                                                                                                • GetCurrentProcess.KERNEL32(?), ref: 006594A8
                                                                                                                                                                • GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,006FA52C,006FA52A), ref: 006597C1
                                                                                                                                                                • GetLastError.KERNEL32(?,?,?,006FA52C,006FA52A), ref: 006597CB
                                                                                                                                                                • GetLongPathNameW.KERNEL32(00000000,?,00000104), ref: 0065987C
                                                                                                                                                                • GetLastError.KERNEL32 ref: 0065989A
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorLastModuleName$AddressCurrentFileHandleLongPathProcProcess
                                                                                                                                                                • String ID: $wn$0pn$0wn$1.1$<wn$GetLongPathName failed (%d) for %s$GetModuleFileName failed (%d)$IsWow64Process$NWebAdvisor::NXmlUpdater::CSubstitutionManager::GetExtractDir$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\SubstitutionManager.cpp$kernel32$>n$rn$vn
                                                                                                                                                                • API String ID: 891933594-114071725
                                                                                                                                                                • Opcode ID: c7efb9dcbc88355bd7b3b1497e804263d808f1fb04b480521afc201fc7b0f944
                                                                                                                                                                • Instruction ID: 0facd72688b12d49187027655ca582c9b99d3b3f5f79b3461134155062147244
                                                                                                                                                                • Opcode Fuzzy Hash: c7efb9dcbc88355bd7b3b1497e804263d808f1fb04b480521afc201fc7b0f944
                                                                                                                                                                • Instruction Fuzzy Hash: 0A727EB0A00214DFDB24DF64CC45B9D77B6AF49305F1042DCEA09AB291DB75AE88CF69
                                                                                                                                                                Function 0065BC60 Relevance: 33.8, APIs: 2, Strings: 17, Instructions: 570fileCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 2822 65bc60-65bd0a call 62347e 2825 65bd0c 2822->2825 2826 65bd0e-65bd14 2822->2826 2825->2826 2827 65bd16 2826->2827 2828 65bd18-65bd39 call 65fbe0 2826->2828 2827->2828 2831 65bd6e-65bd94 PathFindExtensionW call 6a2041 2828->2831 2832 65bd3b-65bd3f 2828->2832 2839 65bd96-65bda8 call 6a2041 2831->2839 2840 65bdaa-65bdbe 2831->2840 2833 65bd41 2832->2833 2834 65bd43-65bd63 call 658650 2832->2834 2833->2834 2841 65be5d-65be5f 2834->2841 2842 65bd69 2834->2842 2839->2840 2853 65bdea-65bdfa call 65bbf0 2839->2853 2844 65bdc0-65bdc5 call 6821d0 2840->2844 2845 65bdc9-65bdce call 66eb20 2840->2845 2847 65be63-65be69 2841->2847 2848 65be4b-65be57 DeleteFileW 2842->2848 2854 65bdc7 2844->2854 2855 65bdd1-65bdd3 2845->2855 2851 65be99-65beb3 2847->2851 2852 65be6b-65be7d 2847->2852 2848->2841 2859 65beb5-65bec7 2851->2859 2860 65bee3-65bf00 call 698367 2851->2860 2856 65be8f-65be96 call 698375 2852->2856 2857 65be7f-65be8d 2852->2857 2872 65be61 2853->2872 2873 65bdfc-65be0e 2853->2873 2854->2855 2855->2853 2862 65bdd5-65bde8 2855->2862 2856->2851 2857->2856 2863 65bf03-65bf63 call 69d60f 2857->2863 2866 65bed9-65bee0 call 698375 2859->2866 2867 65bec9-65bed7 2859->2867 2869 65be37-65be48 call 658650 2862->2869 2881 65bf65-65bf6f 2863->2881 2882 65bf74-65c0e0 call 62347e call 6567e0 call 6238d0 call 62347e call 6567e0 call 6238d0 call 62347e call 6567e0 call 6238d0 call 62347e call 6567e0 call 6238d0 call 62347e call 6567e0 call 6238d0 2863->2882 2866->2860 2867->2863 2867->2866 2869->2848 2872->2847 2876 65be10 2873->2876 2877 65be12-65be1f call 6a2041 2873->2877 2876->2877 2877->2872 2889 65be21-65be32 2877->2889 2884 65c387-65c39d call 658650 2881->2884 2927 65c0e6-65c0ee 2882->2927 2928 65c37d-65c382 2882->2928 2892 65c39f-65c3a4 2884->2892 2889->2869 2894 65c3c7-65c3e4 call 698367 2892->2894 2895 65c3a6-65c3b0 2892->2895 2895->2894 2897 65c3b2-65c3be 2895->2897 2897->2894 2905 65c3c0-65c3c2 2897->2905 2905->2894 2927->2928 2929 65c0f4-65c0fc 2927->2929 2928->2884 2930 65c115-65c121 call 6214c1 2929->2930 2931 65c0fe-65c113 call 6214a1 2929->2931 2936 65c126-65c13c call 6244b2 2930->2936 2931->2936 2939 65c14c-65c153 2936->2939 2940 65c13e-65c147 call 6238d0 2936->2940 2942 65c155-65c161 call 6238d0 2939->2942 2943 65c166-65c171 2939->2943 2940->2939 2942->2943 2945 65c173-65c186 call 6214a1 2943->2945 2946 65c188-65c197 call 6214c1 2943->2946 2951 65c19a-65c1b0 call 6244b2 2945->2951 2946->2951 2954 65c1c3-65c1ca 2951->2954 2955 65c1b2-65c1be call 6238d0 2951->2955 2957 65c1dd-65c1e5 2954->2957 2958 65c1cc-65c1d8 call 6238d0 2954->2958 2955->2954 2960 65c1e7-65c1fa call 6214a1 2957->2960 2961 65c1fc-65c20b call 6214c1 2957->2961 2958->2957 2966 65c20e-65c221 call 6244b2 2960->2966 2961->2966 2969 65c231-65c238 2966->2969 2970 65c223-65c22c call 6238d0 2966->2970 2972 65c245-65c25e call 65a380 2969->2972 2973 65c23a-65c240 call 6238d0 2969->2973 2970->2969 2977 65c264-65c271 call 65a380 2972->2977 2978 65c346-65c34b 2972->2978 2973->2972 2977->2978 2984 65c277-65c284 call 65a380 2977->2984 2979 65c34d-65c35e call 658650 2978->2979 2985 65c361 2979->2985 2984->2978 2990 65c28a-65c297 2984->2990 2987 65c363-65c37b call 6238d0 * 3 2985->2987 2987->2892 2992 65c299 2990->2992 2993 65c29b-65c2aa call 6c4db0 2990->2993 2992->2993 2998 65c2ac-65c2ca call 658650 2993->2998 2999 65c2cf-65c301 call 6214a1 call 6567e0 call 6238d0 2993->2999 2998->2985 3010 65c323-65c33d call 65bc60 2999->3010 3011 65c303-65c310 call 65a380 2999->3011 3014 65c342-65c344 3010->3014 3016 65c312-65c319 3011->3016 3017 65c31b-65c31f 3011->3017 3014->2987 3016->2979 3017->3010 3018 65c321 3017->3018 3018->3010
                                                                                                                                                                APIs
                                                                                                                                                                • PathFindExtensionW.SHLWAPI(00000000,?,?,?,?,006FBFD0,00000000,D8276B9A), ref: 0065BD7A
                                                                                                                                                                • DeleteFileW.KERNEL32(00000000), ref: 0065BE57
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: DeleteExtensionFileFindPath
                                                                                                                                                                • String ID: .cab$.exe$DestDir$DestFile$Location$MD5$NWebAdvisor::NXmlUpdater::CDownloadCommand::DownloadCommand$NWebAdvisor::NXmlUpdater::CDownloadCommand::Execute$Unable to create destination directory (%d)$Unable to download %s$Unable to get substitute download variables$Unable to read Location and/or DestDir attribute of DOWNLOAD command$Unable to verify MD5, deleting file: %s$Unable to verify signature, deleting file: %s$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\DownloadCommand.cpp$extra$invalid substitutor
                                                                                                                                                                • API String ID: 3618814920-733304951
                                                                                                                                                                • Opcode ID: c85bf3cda18cd5f2904ee0c7310f411ec744a9fd5241676ba9fab6553debf19a
                                                                                                                                                                • Instruction ID: 9c566f52a7ae435dbdbea3f42296aa8bb2e4ca4fd9df1667a1ec09383131451a
                                                                                                                                                                • Opcode Fuzzy Hash: c85bf3cda18cd5f2904ee0c7310f411ec744a9fd5241676ba9fab6553debf19a
                                                                                                                                                                • Instruction Fuzzy Hash: C1228B70E00318DFDB20DFA4D895BEDB7B6AF18315F10415DE915AB282DB78AA48CF64
                                                                                                                                                                Function 00630890 Relevance: 30.3, APIs: 13, Strings: 4, Instructions: 560COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 3210 630890-6308e2 call 683bab 3213 631045-631046 call 683faf 3210->3213 3214 6308e8-6308ee 3210->3214 3219 63104b call 69d60f 3213->3219 3216 630a53-630a70 call 69a920 3214->3216 3217 6308f4-63090b ConvertStringSecurityDescriptorToSecurityDescriptorW 3214->3217 3227 630a72 3216->3227 3228 630a75-630ab6 call 633110 3216->3228 3220 630911-630939 3217->3220 3221 63101f-631042 call 683bbc call 698367 3217->3221 3229 631050-631053 3219->3229 3224 63093b 3220->3224 3225 63093d-630942 3220->3225 3224->3225 3230 630945-63094e 3225->3230 3227->3228 3243 630fa9-63101c call 632b90 call 682bfd 3228->3243 3244 630abc-630ac0 3228->3244 3233 631055-63105a 3229->3233 3234 63105c-631069 3229->3234 3230->3230 3235 630950-63099f call 62f520 call 62e640 3230->3235 3237 63106c-631098 call 622a82 call 6228d1 call 69a332 3233->3237 3234->3237 3252 6309a4-6309bf 3235->3252 3243->3221 3248 630ac6-630bba call 698713 call 69a920 call 683367 call 683184 call 6833f6 call 623128 call 683084 call 6831e9 3244->3248 3249 630d19-630d26 3244->3249 3332 630bef-630c12 call 685688 3248->3332 3333 630bbc-630bcc call 683367 3248->3333 3254 630d2a-630d53 call 6289b0 3249->3254 3255 630d28 3249->3255 3259 6309c1-6309d6 3252->3259 3260 6309fc-630a1b 3252->3260 3270 630e00-630e0a 3254->3270 3271 630d59-630d70 call 622c9c 3254->3271 3255->3254 3265 6309d8-6309e6 3259->3265 3266 6309ec-6309f9 call 698375 3259->3266 3267 630a31-630a40 3260->3267 3268 630a1d-630a1f 3260->3268 3265->3219 3265->3266 3266->3260 3276 630a42-630a4f LocalFree 3267->3276 3277 630a51 3267->3277 3268->3221 3274 630a25-630a2c LocalFree 3268->3274 3270->3243 3279 630e10-630e3a call 622c9c 3270->3279 3285 630d72-630d8a 3271->3285 3286 630db8-630dc3 call 6838a1 3271->3286 3274->3221 3276->3216 3277->3216 3289 630e89-630eb2 call 6838a1 3279->3289 3290 630e3c-630e6c call 632380 3279->3290 3285->3286 3312 630d8c-630db2 3285->3312 3300 630dc5-630dc8 call 622510 3286->3300 3301 630dcd-630de5 3286->3301 3306 630eb4-630eb7 call 622510 3289->3306 3307 630ebc 3289->3307 3313 630e6e-630e79 call 6838a1 3290->3313 3300->3301 3304 630de7-630df4 3301->3304 3305 630dfc 3301->3305 3304->3305 3305->3270 3306->3307 3311 630ec0-630ed4 3307->3311 3317 630ed6-630ee3 3311->3317 3318 630eeb-630f0d 3311->3318 3312->3229 3312->3286 3322 630e83-630e87 3313->3322 3323 630e7b-630e7e call 622510 3313->3323 3317->3318 3318->3243 3320 630f13 3318->3320 3324 630f15-630f18 3320->3324 3325 630f1e-630f2b call 633030 3320->3325 3322->3311 3323->3322 3324->3243 3324->3325 3335 630f78-630f82 3325->3335 3336 630f2d-630f63 3325->3336 3343 630c14-630c16 3332->3343 3344 630c5f-630c7e call 632c50 3332->3344 3346 630bde-630bec call 6833bf 3333->3346 3347 630bce-630bd9 3333->3347 3340 630f86-630fa4 call 62e790 call 631740 3335->3340 3341 630f84 3335->3341 3336->3335 3339 630f65-630f68 3336->3339 3339->3234 3345 630f6e-630f73 3339->3345 3340->3243 3341->3340 3349 630c21-630c2d 3343->3349 3350 630c18-630c1e call 69e960 3343->3350 3359 630c80-630c9a 3344->3359 3360 630caf-630cb4 3344->3360 3345->3237 3346->3332 3347->3346 3356 630c30-630c34 3349->3356 3350->3349 3356->3356 3362 630c36-630c4e call 6a594f 3356->3362 3359->3360 3374 630c9c-630caa 3359->3374 3364 630ce2-630ceb 3360->3364 3365 630cb6-630ccd 3360->3365 3362->3344 3369 630c50-630c5c call 69a3a0 3362->3369 3364->3249 3367 630ced-630d04 3364->3367 3365->3364 3377 630ccf-630cdd 3365->3377 3367->3249 3380 630d06-630d14 3367->3380 3369->3344 3374->3360 3377->3364 3380->3249
                                                                                                                                                                APIs
                                                                                                                                                                • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA),00000001,?,00000000), ref: 00630903
                                                                                                                                                                • LocalFree.KERNEL32(?,?), ref: 00630A26
                                                                                                                                                                • LocalFree.KERNEL32(?,?), ref: 00630A43
                                                                                                                                                                  • Part of subcall function 00622510: __EH_prolog3_catch.LIBCMT ref: 00622517
                                                                                                                                                                • std::_Lockit::_Lockit.LIBCPMT ref: 00630B08
                                                                                                                                                                • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00630B50
                                                                                                                                                                • std::_Locinfo::~_Locinfo.LIBCPMT ref: 00630B86
                                                                                                                                                                • std::locale::_Init.LIBCPMT ref: 00630B97
                                                                                                                                                                • std::locale::_Locimp::_New_Locimp.LIBCPMT ref: 00630BA4
                                                                                                                                                                • std::_Lockit::_Lockit.LIBCPMT ref: 00630BC0
                                                                                                                                                                • std::_Lockit::~_Lockit.LIBCPMT ref: 00630BE1
                                                                                                                                                                • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00630BF2
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00631017
                                                                                                                                                                • __Mtx_unlock.LIBCPMT ref: 00631020
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$Lockitstd::locale::_$DescriptorFreeLocalLocimp::_Lockit::_Security$AddfacConvertH_prolog3_catchInitIos_base_dtorLocimpLocimp_LocinfoLocinfo::_Locinfo::~_Locinfo_ctorLockit::~_Mtx_unlockNew_Stringstd::ios_base::_
                                                                                                                                                                • String ID: D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA)$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                                                                                                                                                                • API String ID: 4127577005-3388121372
                                                                                                                                                                • Opcode ID: e6cefa987b84215c34896d236ec36b9bfc81593de88f459dd18b4eab71fea5fc
                                                                                                                                                                • Instruction ID: 715e8f2b42f7c36a79a17fc4f5c13fccf3fe13818affff0afb9edd93c0ad0363
                                                                                                                                                                • Opcode Fuzzy Hash: e6cefa987b84215c34896d236ec36b9bfc81593de88f459dd18b4eab71fea5fc
                                                                                                                                                                • Instruction Fuzzy Hash: 4A329C70D00258CFDB14DFA8C955BEDBBB6AF08304F1441A9E949AB391DB71AE84CF91
                                                                                                                                                                Function 006459AA Relevance: 28.4, APIs: 7, Strings: 9, Instructions: 407COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 3495 6459aa-645b7a call 646440 call 639180 3508 645b7f-645b81 3495->3508 3509 645b7a call 639180 3495->3509 3510 645bc4-645be0 call 6211f3 3508->3510 3511 645b83-645b8d 3508->3511 3509->3508 3519 645be6-645c59 call 629bb0 call 629940 call 621b84 call 621be0 call 62b8a0 call 682bfd 3510->3519 3520 645cfc-645d06 3510->3520 3513 645b93-645ba5 3511->3513 3514 645c8d-645ccd call 646440 3511->3514 3517 645c83-645c8a call 698375 3513->3517 3518 645bab-645bbf 3513->3518 3526 645db3-645dc0 3514->3526 3527 645cd3-645cd8 3514->3527 3517->3514 3518->3517 3519->3514 3609 645c5b-645c6d 3519->3609 3528 645d08-645d1a 3520->3528 3529 645d3a-645d67 call 646440 3520->3529 3534 645dc2-645dc7 3526->3534 3535 645dc9-645dce 3526->3535 3532 645cdc-645cf7 call 69a3a0 3527->3532 3533 645cda 3527->3533 3536 645d30-645d37 call 698375 3528->3536 3537 645d1c-645d2a 3528->3537 3544 645d78-645d82 3529->3544 3545 645d69-645d73 call 63aad0 3529->3545 3557 645e8e-645e98 3532->3557 3533->3532 3542 645dd1-645de5 3534->3542 3535->3542 3536->3529 3537->3536 3548 645de7-645dec 3542->3548 3549 645e30-645e32 3542->3549 3544->3514 3556 645d88-645d94 3544->3556 3545->3544 3550 646085 Concurrency::cancel_current_task 3548->3550 3551 645df2-645dfd call 698713 3548->3551 3552 645e64-645e86 3549->3552 3553 645e34-645e62 call 698713 3549->3553 3565 64608a call 69d60f 3550->3565 3551->3565 3576 645e03-645e2e 3551->3576 3561 645e8c 3552->3561 3553->3561 3556->3517 3562 645d9a-645dae 3556->3562 3563 645ec6-645eee call 639980 3557->3563 3564 645e9a-645ea6 3557->3564 3561->3557 3562->3517 3580 645ef4-645f34 call 646440 3563->3580 3581 645f7f 3563->3581 3571 645ebc-645ec3 call 698375 3564->3571 3572 645ea8-645eb6 3564->3572 3574 64608f-6460aa call 69d60f 3565->3574 3571->3563 3572->3565 3572->3571 3590 6460ac-6460b6 3574->3590 3591 6460d8-6460fc call 6467b0 3574->3591 3576->3561 3597 645f45-645f4f 3580->3597 3598 645f36-645f40 call 63aad0 3580->3598 3587 645f82-645f93 GetModuleHandleW 3581->3587 3588 645f95-645fa5 GetProcAddress 3587->3588 3589 645fd1 3587->3589 3588->3589 3594 645fa7-645fc5 GetCurrentProcess 3588->3594 3599 645fd3-64605c call 646440 call 6236db call 62372a * 3 call 698367 3589->3599 3595 6460ce-6460d5 call 698375 3590->3595 3596 6460b8-6460c6 3590->3596 3617 646144-646149 3591->3617 3618 6460fe-646106 3591->3618 3594->3589 3639 645fc7-645fcb 3594->3639 3595->3591 3602 6461d4-6461d9 call 69d60f 3596->3602 3603 6460cc 3596->3603 3597->3587 3606 645f51-645f5d 3597->3606 3598->3597 3603->3595 3613 645f73-645f7d call 698375 3606->3613 3614 645f5f-645f6d 3606->3614 3609->3517 3610 645c6f-645c7d 3609->3610 3610->3517 3613->3587 3614->3574 3614->3613 3619 64618f-646197 3617->3619 3620 64614b-646151 3617->3620 3624 64613d 3618->3624 3625 646108-64610c 3618->3625 3626 6461c0-6461d3 3619->3626 3627 646199-6461a2 3619->3627 3629 646153-646157 3620->3629 3630 646188 3620->3630 3624->3617 3633 64610e-646115 SysFreeString 3625->3633 3634 64611b-646120 3625->3634 3637 6461a4-6461b2 3627->3637 3638 6461b6-6461bd call 698375 3627->3638 3640 646166-64616b 3629->3640 3641 646159-646160 SysFreeString 3629->3641 3630->3619 3633->3634 3635 646132-64613a call 698375 3634->3635 3636 646122-64612b call 69874c 3634->3636 3635->3624 3636->3635 3637->3602 3645 6461b4 3637->3645 3638->3626 3639->3589 3646 645fcd-645fcf 3639->3646 3648 64617d-646185 call 698375 3640->3648 3649 64616d-646176 call 69874c 3640->3649 3641->3640 3645->3638 3646->3599 3648->3630 3649->3648
                                                                                                                                                                APIs
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 00646067
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 00646085
                                                                                                                                                                • SysFreeString.OLEAUT32 ref: 0064610F
                                                                                                                                                                • SysFreeString.OLEAUT32(00000000), ref: 0064615A
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Concurrency::cancel_current_taskFreeString
                                                                                                                                                                • String ID: )$0o$4o$IsWow64Process$NO_REGKEY$UUID$UUID$kernel32$orm
                                                                                                                                                                • API String ID: 3597043392-3178101054
                                                                                                                                                                • Opcode ID: bc0a5f8c2f098e288fa660d2e9eb589e0f2c244ba1e24ff8e730bec7d117a9ea
                                                                                                                                                                • Instruction ID: ce0cd3ea595b64fe9651b406dc91759a3fcbf6f83a7e833d09e6db122ce19afc
                                                                                                                                                                • Opcode Fuzzy Hash: bc0a5f8c2f098e288fa660d2e9eb589e0f2c244ba1e24ff8e730bec7d117a9ea
                                                                                                                                                                • Instruction Fuzzy Hash: B8E1E4709007449FEF28DFA8D94879DBBB7AF42300F24425CE406AB7D2DB759984CB96
                                                                                                                                                                Function 00656560 Relevance: 25.7, APIs: 14, Strings: 3, Instructions: 211memoryCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 4028 656560-65658d 4029 65658f-656592 GlobalFree 4028->4029 4030 656599-65659e 4028->4030 4029->4030 4031 6565a0-6565a3 GlobalFree 4030->4031 4032 6565aa-6565af 4030->4032 4031->4032 4033 6565b1-6565b4 GlobalFree 4032->4033 4034 6565bb-6565c8 4032->4034 4033->4034 4036 65668c 4034->4036 4037 6565ce-6565d3 4034->4037 4038 65668e-656693 4036->4038 4039 6566cd-6566d1 4037->4039 4040 6565d9-6565de 4037->4040 4041 656695-656698 GlobalFree 4038->4041 4042 65669f-6566a4 4038->4042 4043 6566d3-6566d7 4039->4043 4044 6566dd-6566ef 4039->4044 4045 6565e0-6565e3 GlobalFree 4040->4045 4046 6565ea-6565ec 4040->4046 4041->4042 4049 6566a6-6566a9 GlobalFree 4042->4049 4050 6566b0-6566b6 4042->4050 4043->4044 4051 6567d0-6567d2 4043->4051 4052 6566f1-6566fb 4044->4052 4053 6566fd-656704 4044->4053 4045->4046 4047 6565ee-6565f0 4046->4047 4048 65662b-656633 4046->4048 4054 6565f3-6565fc 4047->4054 4057 656635-656638 GlobalFree 4048->4057 4058 65663f-656641 4048->4058 4049->4050 4055 6566b8-6566b9 GlobalFree 4050->4055 4056 6566bb-6566cc call 698367 4050->4056 4051->4038 4059 65670b-65672a 4052->4059 4053->4059 4054->4054 4060 6565fe-656618 GlobalAlloc 4054->4060 4055->4056 4057->4058 4058->4051 4062 656647-65664c 4058->4062 4059->4036 4067 656730-65676b 4059->4067 4060->4036 4064 65661a-656629 call 69d660 4060->4064 4066 656650-656659 4062->4066 4064->4036 4064->4048 4066->4066 4069 65665b-656675 GlobalAlloc 4066->4069 4076 656794-656798 4067->4076 4077 65676d-656779 4067->4077 4069->4036 4071 656677-656686 call 69d660 4069->4071 4071->4036 4071->4051 4080 6567ae-6567ba 4076->4080 4081 65679a-6567a9 call 656a70 call 656af0 4076->4081 4078 656781-656786 4077->4078 4079 65677b-65677e GlobalFree 4077->4079 4078->4036 4084 65678c-65678f GlobalFree 4078->4084 4079->4078 4082 6567c6-6567cb 4080->4082 4083 6567bc-6567bf GlobalFree 4080->4083 4081->4080 4082->4051 4086 6567cd-6567ce GlobalFree 4082->4086 4083->4082 4084->4036 4086->4051
                                                                                                                                                                APIs
                                                                                                                                                                • GlobalFree.KERNEL32(?), ref: 00656590
                                                                                                                                                                • GlobalFree.KERNEL32(?), ref: 006565A1
                                                                                                                                                                • GlobalFree.KERNEL32(00000101), ref: 006565B2
                                                                                                                                                                • GlobalFree.KERNEL32(?), ref: 006565E1
                                                                                                                                                                • GlobalAlloc.KERNEL32(00000000,?), ref: 0065660D
                                                                                                                                                                • GlobalFree.KERNEL32(00000101), ref: 00656636
                                                                                                                                                                • GlobalAlloc.KERNEL32(00000000,?), ref: 0065666A
                                                                                                                                                                • GlobalFree.KERNEL32(?), ref: 00656696
                                                                                                                                                                • GlobalFree.KERNEL32(?), ref: 006566A7
                                                                                                                                                                • GlobalFree.KERNEL32(?), ref: 006566B9
                                                                                                                                                                • GlobalFree.KERNEL32(00000000), ref: 0065677C
                                                                                                                                                                • GlobalFree.KERNEL32(00000000), ref: 0065678D
                                                                                                                                                                • GlobalFree.KERNEL32(00000000), ref: 006567BD
                                                                                                                                                                • GlobalFree.KERNEL32(00000000), ref: 006567CE
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Global$Free$Alloc
                                                                                                                                                                • String ID: Temp$\$n$`avo
                                                                                                                                                                • API String ID: 1780285237-758998320
                                                                                                                                                                • Opcode ID: 27b6adf3596c753e5bd177c65ae274d585858120728a5b556c621faa30b552cf
                                                                                                                                                                • Instruction ID: 65558a4a567dd6cb1b1445707902fae90725acf97c8190c0cd4f6919bc4fdd38
                                                                                                                                                                • Opcode Fuzzy Hash: 27b6adf3596c753e5bd177c65ae274d585858120728a5b556c621faa30b552cf
                                                                                                                                                                • Instruction Fuzzy Hash: D8714AB0E002199BDF109FA5CC94BEEFBBAAF04705F458159FC01AB395EB75D909CA60
                                                                                                                                                                Function 0063CE00 Relevance: 25.0, APIs: 2, Strings: 12, Instructions: 545COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 4089 63ce00-63d2f7 call 698713 * 6 call 683b8a call 69a920 * 2 call 641770 call 62bbb0 call 62bed0 4114 63d2f9-63d30e 4089->4114 4115 63d32e-63d3ac call 624300 * 5 call 62ba20 4089->4115 4116 63d310-63d31e 4114->4116 4117 63d324-63d32b call 698375 4114->4117 4141 63d414-63d41d 4115->4141 4142 63d3ae-63d3b4 4115->4142 4116->4117 4119 63d707-63d71d call 69d60f call 639c10 4116->4119 4117->4115 4131 63d71f-63d72a call 698375 4119->4131 4132 63d72d-63d730 4119->4132 4131->4132 4143 63d454-63d46c call 69a920 call 63ccb0 4141->4143 4144 63d41f-63d434 4141->4144 4145 63d3b6-63d3c5 4142->4145 4146 63d3ed-63d412 4142->4146 4162 63d471-63d481 4143->4162 4147 63d436-63d444 4144->4147 4148 63d44a-63d451 call 698375 4144->4148 4150 63d3c7-63d3d5 4145->4150 4151 63d3dd-63d3ea call 698375 4145->4151 4146->4143 4147->4148 4152 63d6f8 call 69d60f 4147->4152 4148->4143 4150->4152 4155 63d3db 4150->4155 4151->4146 4161 63d6fd call 6234d0 4152->4161 4155->4151 4166 63d702 call 6234d0 4161->4166 4164 63d483-63d494 4162->4164 4165 63d4d8-63d4e9 4162->4165 4164->4161 4168 63d49a-63d4a0 4164->4168 4165->4166 4167 63d4ef-63d4f5 4165->4167 4166->4119 4169 63d4f7 4167->4169 4170 63d4f9-63d4fd 4167->4170 4172 63d4a2 4168->4172 4173 63d4a4-63d4a8 4168->4173 4169->4170 4174 63d501-63d522 call 6240e8 4170->4174 4175 63d4ff 4170->4175 4172->4173 4176 63d4aa 4173->4176 4177 63d4ac-63d4d6 call 6240e8 4173->4177 4182 63d527-63d52f 4174->4182 4175->4174 4176->4177 4177->4182 4183 63d531-63d537 4182->4183 4184 63d597-63d59f 4182->4184 4187 63d56a-63d594 4183->4187 4188 63d539-63d548 4183->4188 4185 63d5a1-63d5b3 4184->4185 4186 63d5f0-63d5f9 4184->4186 4185->4186 4189 63d5b5-63d5ca 4185->4189 4190 63d63b-63d689 call 629bb0 call 629940 call 621b84 call 624200 4186->4190 4191 63d5fb-63d604 4186->4191 4187->4184 4192 63d560-63d567 call 698375 4188->4192 4193 63d54a-63d558 4188->4193 4196 63d5e0-63d5ed call 698375 4189->4196 4197 63d5cc-63d5da 4189->4197 4214 63d68b 4190->4214 4215 63d68d-63d6f7 call 624190 call 62b8a0 call 682bfd call 63d740 call 698367 4190->4215 4191->4190 4198 63d606-63d61b 4191->4198 4192->4187 4193->4119 4199 63d55e 4193->4199 4196->4186 4197->4119 4197->4196 4203 63d631-63d638 call 698375 4198->4203 4204 63d61d-63d62b 4198->4204 4199->4192 4203->4190 4204->4119 4204->4203 4214->4215
                                                                                                                                                                APIs
                                                                                                                                                                • __Mtx_init_in_situ.LIBCPMT ref: 0063D1E6
                                                                                                                                                                  • Part of subcall function 0062BBB0: std::locale::_Init.LIBCPMT ref: 0062BBFC
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0063D6C4
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: InitIos_base_dtorMtx_init_in_situstd::ios_base::_std::locale::_
                                                                                                                                                                • String ID: $+n$$o$.servicebus.windows.net/$/messages?timeout=60&api-version=2014-01$<o$@o$AWS m_url_aws = $Content-Type: application/atom+xml;type=entry;charset=utf-8$`o$https://$u$*n
                                                                                                                                                                • API String ID: 655687434-758135681
                                                                                                                                                                • Opcode ID: 2a598f9a89e0c3a0d6d1f569de37e2cfa78203869bbfe29784a1b651e63496fa
                                                                                                                                                                • Instruction ID: 3f3c96578d9244284695b01c3bed491649e790a7915c62311e63fc4fa6085b17
                                                                                                                                                                • Opcode Fuzzy Hash: 2a598f9a89e0c3a0d6d1f569de37e2cfa78203869bbfe29784a1b651e63496fa
                                                                                                                                                                • Instruction Fuzzy Hash: 0242AF70900745CFDB14CF28DC45BA9BBB2BF55308F0056ADE548AB662EB71AAC4CF94
                                                                                                                                                                Function 0063E380 Relevance: 21.3, APIs: 5, Strings: 7, Instructions: 271COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0063E4A1
                                                                                                                                                                  • Part of subcall function 0063DE80: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0063DF0C
                                                                                                                                                                • __Mtx_unlock.LIBCPMT ref: 0063E3DE
                                                                                                                                                                  • Part of subcall function 0063E0D0: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0063E161
                                                                                                                                                                • __Mtx_unlock.LIBCPMT ref: 0063E4FB
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0063E665
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0063E6F8
                                                                                                                                                                  • Part of subcall function 00629BB0: InitOnceBeginInitialize.KERNEL32(007180C4,00000000,D8276B9A,00000000,D8276B9A,0062A219,007180CC,?,?,?,?,?,?,0062A219,?,?), ref: 00629BE5
                                                                                                                                                                  • Part of subcall function 00629BB0: InitOnceComplete.KERNEL32(007180C4,00000000,00000000), ref: 00629C1D
                                                                                                                                                                  • Part of subcall function 00629940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00629A12
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Ios_base_dtorstd::ios_base::_$InitMtx_unlockOnce$BeginCompleteInitialize
                                                                                                                                                                • String ID: AdhocTelemetryAzure$Event string is empty$Querying AdhocTelemetryAzure value failed: $SOFTWARE\McAfee\WebAdvisor$]$`o$`o]
                                                                                                                                                                • API String ID: 1670716954-3166977646
                                                                                                                                                                • Opcode ID: bed3c9b7ee43ed8d6e55e0e0374fb69b7ebfde7892a9e2f07707de922340eac2
                                                                                                                                                                • Instruction ID: 98ea6ad0a0f12305a320609525735a30d273c3cfeb577d6d89942676c9ef6830
                                                                                                                                                                • Opcode Fuzzy Hash: bed3c9b7ee43ed8d6e55e0e0374fb69b7ebfde7892a9e2f07707de922340eac2
                                                                                                                                                                • Instruction Fuzzy Hash: 1D91017190022C9BDB50EF50DC42BEEB7BAEF55314F0001ADE909A7381EB755A48CFA5
                                                                                                                                                                Function 00645A23 Relevance: 21.3, APIs: 3, Strings: 9, Instructions: 265COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 00646085
                                                                                                                                                                • SysFreeString.OLEAUT32 ref: 0064610F
                                                                                                                                                                • SysFreeString.OLEAUT32(00000000), ref: 0064615A
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FreeString$Concurrency::cancel_current_task
                                                                                                                                                                • String ID: )$0o$4o$IsWow64Process$NO_REGKEY$UUID$UUID$kernel32$orm
                                                                                                                                                                • API String ID: 2663709405-3178101054
                                                                                                                                                                • Opcode ID: 45cb8b51d4da05e78e3d8a97d8e75bb69b1051cc5a85d86e35a764d6bba103df
                                                                                                                                                                • Instruction ID: 92b7e72648b78cae6af1f9ff330dba8adc282dea59318bc8eb705055077d6c61
                                                                                                                                                                • Opcode Fuzzy Hash: 45cb8b51d4da05e78e3d8a97d8e75bb69b1051cc5a85d86e35a764d6bba103df
                                                                                                                                                                • Instruction Fuzzy Hash: 12B1D0709003489BEF14DFA8D94879DBFB7AF45304F24425CE405AB392DBB99A84CB56
                                                                                                                                                                Function 00634200 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 337COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • OpenProcess.KERNEL32(00000400,00000000,?,D8276B9A,?,?), ref: 00634257
                                                                                                                                                                • GetLastError.KERNEL32(?,00000001,?,?), ref: 006342BC
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 006342F2
                                                                                                                                                                • QueryFullProcessImageNameW.KERNEL32(00000000,00000000,00000000,?,00000104,00000000,?,?), ref: 00634367
                                                                                                                                                                • GetLastError.KERNEL32(?,?), ref: 00634375
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0063440A
                                                                                                                                                                • CloseHandle.KERNEL32(00000000,?), ref: 0063455B
                                                                                                                                                                  • Part of subcall function 00629BB0: InitOnceBeginInitialize.KERNEL32(007180C4,00000000,D8276B9A,00000000,D8276B9A,0062A219,007180CC,?,?,?,?,?,?,0062A219,?,?), ref: 00629BE5
                                                                                                                                                                  • Part of subcall function 00629BB0: InitOnceComplete.KERNEL32(007180C4,00000000,00000000), ref: 00629C1D
                                                                                                                                                                  • Part of subcall function 00629940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00629A12
                                                                                                                                                                Strings
                                                                                                                                                                • Filename for process with id , xrefs: 006344B0
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Ios_base_dtorstd::ios_base::_$ErrorInitLastOnceProcess$BeginCloseCompleteFullHandleImageInitializeNameOpenQuery
                                                                                                                                                                • String ID: Filename for process with id
                                                                                                                                                                • API String ID: 563014942-4200337779
                                                                                                                                                                • Opcode ID: 505b14e1c5af4e2995a60395f083dd35cb42f8b6be49e3daf5490b8cd200115a
                                                                                                                                                                • Instruction ID: 90aa047dc1189d3e377f14dc6ec5a9b76aa71c5c7684da11efd78d2bd05e295f
                                                                                                                                                                • Opcode Fuzzy Hash: 505b14e1c5af4e2995a60395f083dd35cb42f8b6be49e3daf5490b8cd200115a
                                                                                                                                                                • Instruction Fuzzy Hash: F4D19970D102199BCB20DFA4DC85BEEBBB6FF44314F10466DE419A7681EBB46A48CF94
                                                                                                                                                                Function 006C00DE Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 006BFE25: CreateFileW.KERNEL32(00000000,00000000,?,006C0187,?,?,00000000,?,006C0187,00000000,0000000C), ref: 006BFE42
                                                                                                                                                                • GetLastError.KERNEL32 ref: 006C01F2
                                                                                                                                                                • __dosmaperr.LIBCMT ref: 006C01F9
                                                                                                                                                                • GetFileType.KERNEL32(00000000), ref: 006C0205
                                                                                                                                                                • GetLastError.KERNEL32 ref: 006C020F
                                                                                                                                                                • __dosmaperr.LIBCMT ref: 006C0218
                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 006C0238
                                                                                                                                                                • CloseHandle.KERNEL32(?), ref: 006C0385
                                                                                                                                                                • GetLastError.KERNEL32 ref: 006C03B7
                                                                                                                                                                • __dosmaperr.LIBCMT ref: 006C03BE
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                                                                                                                                                                • String ID: isk
                                                                                                                                                                • API String ID: 4237864984-1714797400
                                                                                                                                                                • Opcode ID: 324887d0711c4ebe0b631521333d115a09dbf974711079ad326ac174c017df4a
                                                                                                                                                                • Instruction ID: 6a5318e0344a462577cf4a06642cb9d61656c346572b0d6097fa08db80824107
                                                                                                                                                                • Opcode Fuzzy Hash: 324887d0711c4ebe0b631521333d115a09dbf974711079ad326ac174c017df4a
                                                                                                                                                                • Instruction Fuzzy Hash: F3A1F032A041859FDF19AFA8DC51BFE7BB6EB06324F18415DE811AF3A1C6358902CB55
                                                                                                                                                                Function 00633D80 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 188COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • WTSGetActiveConsoleSessionId.KERNEL32(0000003C,?), ref: 00633E00
                                                                                                                                                                • OutputDebugStringW.KERNEL32(WTSQuerySessionInformation failed to retrieve current user name for the log name.), ref: 00633F9C
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 00633FCA
                                                                                                                                                                Strings
                                                                                                                                                                • WTSQuerySessionInformation failed to retrieve the size of the current user name for the log name., xrefs: 00633F81
                                                                                                                                                                • UNKNOWN, xrefs: 00633DD2
                                                                                                                                                                • WTSQuerySessionInformation failed to retrieve current user name for the log name., xrefs: 00633F97
                                                                                                                                                                • Error retrieving session id for generating log name., xrefs: 00633E0B
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ActiveConcurrency::cancel_current_taskConsoleDebugOutputSessionString
                                                                                                                                                                • String ID: Error retrieving session id for generating log name.$UNKNOWN$WTSQuerySessionInformation failed to retrieve current user name for the log name.$WTSQuerySessionInformation failed to retrieve the size of the current user name for the log name.
                                                                                                                                                                • API String ID: 1186403813-1860316991
                                                                                                                                                                • Opcode ID: b1f02788ca8598c8b2cc6845da79f7a92a36481d47c158a56e3becf07c380bc6
                                                                                                                                                                • Instruction ID: 2916b7daf728265f1f4db0db72fd0dbeb5ae80e00ab54953c43da2a9a68476f6
                                                                                                                                                                • Opcode Fuzzy Hash: b1f02788ca8598c8b2cc6845da79f7a92a36481d47c158a56e3becf07c380bc6
                                                                                                                                                                • Instruction Fuzzy Hash: D551B171E002259FCB149FB4D885AAEBBB6FF48310F60462EE516D7790D7749A40CBE4
                                                                                                                                                                Function 00699900 Relevance: 13.7, APIs: 9, Instructions: 154memoryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,00644AA5,00644AA7,00000000,00000000,D8276B9A,?,00000000,?,0069BE00,0070BF08,000000FE,?,00644AA5,?), ref: 00699989
                                                                                                                                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,00644AA5,?,00000000,00000000,?,0069BE00,0070BF08,000000FE,?,00644AA5), ref: 00699A04
                                                                                                                                                                • SysAllocString.OLEAUT32(00000000), ref: 00699A0F
                                                                                                                                                                • _com_issue_error.COMSUPP ref: 00699A38
                                                                                                                                                                • _com_issue_error.COMSUPP ref: 00699A42
                                                                                                                                                                • GetLastError.KERNEL32(80070057,D8276B9A,?,00000000,?,0069BE00,0070BF08,000000FE,?,00644AA5,?), ref: 00699A47
                                                                                                                                                                • _com_issue_error.COMSUPP ref: 00699A5A
                                                                                                                                                                • GetLastError.KERNEL32(00000000,?,00000000,?,0069BE00,0070BF08,000000FE,?,00644AA5,?), ref: 00699A70
                                                                                                                                                                • _com_issue_error.COMSUPP ref: 00699A83
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1353541977-0
                                                                                                                                                                • Opcode ID: 3dc2f14e53d8d1c70701b05916d185f27384ad86858ec76644cb50afdf4b0bfc
                                                                                                                                                                • Instruction ID: 0ebf017ce88e2f234db7b8bfc96f1ea2b5043189851ad027e8a41e7327e33c10
                                                                                                                                                                • Opcode Fuzzy Hash: 3dc2f14e53d8d1c70701b05916d185f27384ad86858ec76644cb50afdf4b0bfc
                                                                                                                                                                • Instruction Fuzzy Hash: B541F471A002059BDF10EF69DC45BAEBBAEEB49750F14462EF505E7681DB359800CBB4
                                                                                                                                                                Function 0063EEC0 Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 323COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 0063CCB0: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0063CDBB
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 0063F0FC
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0063F268
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0063F307
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Ios_base_dtorstd::ios_base::_$Concurrency::cancel_current_task
                                                                                                                                                                • String ID: AdhocTelemetryAWS$Querying AdhocTelemetryAWS value failed: $SOFTWARE\McAfee\WebAdvisor$`o
                                                                                                                                                                • API String ID: 1722207485-3517542603
                                                                                                                                                                • Opcode ID: 7aecafec81cb0066a434a0162ccb360e2bab8d4bd0505e61bd303ce77201e137
                                                                                                                                                                • Instruction ID: fa809cb491d82b0ae935955a6e96b617abc9c82c75a025961383fb9860996f88
                                                                                                                                                                • Opcode Fuzzy Hash: 7aecafec81cb0066a434a0162ccb360e2bab8d4bd0505e61bd303ce77201e137
                                                                                                                                                                • Instruction Fuzzy Hash: C8C1B0B0D042589BCB58DFA8CC55BEEB7BAEF05310F1042ADE419A7381EB705A45CFA5
                                                                                                                                                                Function 00629C50 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 313COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 0062E310: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA),00000001,00000000,00000000), ref: 0062E36C
                                                                                                                                                                • __Mtx_init_in_situ.LIBCPMT ref: 00629DD4
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 0062A06D
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: DescriptorSecurity$Concurrency::cancel_current_taskConvertMtx_init_in_situString
                                                                                                                                                                • String ID: LogLevel$LogRotationCount$LogRotationFileSize$SOFTWARE\McAfee\WebAdvisor$log
                                                                                                                                                                • API String ID: 239504998-2017128786
                                                                                                                                                                • Opcode ID: ea94950ccf4cac54f71a0e727ea0008e06bcca71a3d5ca6712718c84afe4ed05
                                                                                                                                                                • Instruction ID: 015f475c9156ad3097e6a58720eaf77edef49c2370fbc93629fdc9904d81d23f
                                                                                                                                                                • Opcode Fuzzy Hash: ea94950ccf4cac54f71a0e727ea0008e06bcca71a3d5ca6712718c84afe4ed05
                                                                                                                                                                • Instruction Fuzzy Hash: B6C1BA71D006099FCB00DFA4D941BEEBBB6BF48304F20421DE405AB391EB75AA44CF91
                                                                                                                                                                Function 0063E0D0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 171COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0063E161
                                                                                                                                                                • GetLastError.KERNEL32(?,00000001), ref: 0063E278
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0063E351
                                                                                                                                                                  • Part of subcall function 00629BB0: InitOnceBeginInitialize.KERNEL32(007180C4,00000000,D8276B9A,00000000,D8276B9A,0062A219,007180CC,?,?,?,?,?,?,0062A219,?,?), ref: 00629BE5
                                                                                                                                                                  • Part of subcall function 00629BB0: InitOnceComplete.KERNEL32(007180C4,00000000,00000000), ref: 00629C1D
                                                                                                                                                                  • Part of subcall function 00629940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00629A12
                                                                                                                                                                Strings
                                                                                                                                                                • Unable to open HTTP session for AWS, xrefs: 0063E327
                                                                                                                                                                • WinHttpCrackUrl failed for AWS: , xrefs: 0063E268
                                                                                                                                                                • Event Sender already initialized for AWS, xrefs: 0063E137
                                                                                                                                                                • `o, xrefs: 0063E30E
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Ios_base_dtorstd::ios_base::_$InitOnce$BeginCompleteErrorInitializeLast
                                                                                                                                                                • String ID: Event Sender already initialized for AWS$Unable to open HTTP session for AWS$WinHttpCrackUrl failed for AWS: $`o
                                                                                                                                                                • API String ID: 2211357200-1947869502
                                                                                                                                                                • Opcode ID: 7ac8c3c4b7463ec580dfc78da2be38dd151b0462eaa585660c857d252abb2590
                                                                                                                                                                • Instruction ID: 4e7177bf95a2bf78e3a953036f6854dcb3d6ac70d0a6011c584994d622c275a6
                                                                                                                                                                • Opcode Fuzzy Hash: 7ac8c3c4b7463ec580dfc78da2be38dd151b0462eaa585660c857d252abb2590
                                                                                                                                                                • Instruction Fuzzy Hash: 7061BF70900B198BDB64DFA0DC55BEAB7BAFB44305F00056DE519A7280EBB16A48CFA5
                                                                                                                                                                Function 00636D24 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 166COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __Mtx_init_in_situ.LIBCPMT ref: 00636D7B
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00636F75
                                                                                                                                                                • __Mtx_unlock.LIBCPMT ref: 00636F88
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Ios_base_dtorMtx_init_in_situMtx_unlockstd::ios_base::_
                                                                                                                                                                • String ID: event sender$=$Failed to initialize $async
                                                                                                                                                                • API String ID: 3676452600-816272291
                                                                                                                                                                • Opcode ID: f2faf68147025b0aa61b6d1edbb6a85bda86c748adb6a0af912ad5ce9c944a4d
                                                                                                                                                                • Instruction ID: 15823e0ef544b965b5ec5139c5b9cdefd3bcb57adb2cef128ec0b6afe5c2fd83
                                                                                                                                                                • Opcode Fuzzy Hash: f2faf68147025b0aa61b6d1edbb6a85bda86c748adb6a0af912ad5ce9c944a4d
                                                                                                                                                                • Instruction Fuzzy Hash: 8D61B070A003199FDB40DFA0D855BEEBBB7AF54300F54409DE805AB381DBB19A48CFA5
                                                                                                                                                                Function 0063DE80 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 147COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0063DF0C
                                                                                                                                                                • GetLastError.KERNEL32(?,00000001), ref: 0063DFD7
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0063E0A2
                                                                                                                                                                  • Part of subcall function 00629BB0: InitOnceBeginInitialize.KERNEL32(007180C4,00000000,D8276B9A,00000000,D8276B9A,0062A219,007180CC,?,?,?,?,?,?,0062A219,?,?), ref: 00629BE5
                                                                                                                                                                  • Part of subcall function 00629BB0: InitOnceComplete.KERNEL32(007180C4,00000000,00000000), ref: 00629C1D
                                                                                                                                                                  • Part of subcall function 00629940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00629A12
                                                                                                                                                                Strings
                                                                                                                                                                • Unable to open HTTP session for Azure, xrefs: 0063E078
                                                                                                                                                                • Event Sender already initialized for Azure, xrefs: 0063DEE2
                                                                                                                                                                • WinHttpCrackUrl failed for Azure: , xrefs: 0063DFC7
                                                                                                                                                                • `o, xrefs: 0063E05F
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Ios_base_dtorstd::ios_base::_$InitOnce$BeginCompleteErrorInitializeLast
                                                                                                                                                                • String ID: Event Sender already initialized for Azure$Unable to open HTTP session for Azure$WinHttpCrackUrl failed for Azure: $`o
                                                                                                                                                                • API String ID: 2211357200-2583797527
                                                                                                                                                                • Opcode ID: 9beb3aeb473946d796013a0ca31b5236a749da876397e6965ad002b98b103205
                                                                                                                                                                • Instruction ID: 0bafef8b29d1be1b7bea5820d522da927fa34a4ed34676cbff7ac05e0a715575
                                                                                                                                                                • Opcode Fuzzy Hash: 9beb3aeb473946d796013a0ca31b5236a749da876397e6965ad002b98b103205
                                                                                                                                                                • Instruction Fuzzy Hash: 0551D0709007588FDB64DF50D855BEEB7BAFB14304F00459DE80AA7380EBB46A48CFA5
                                                                                                                                                                Function 0063928D Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 130COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00638FB0: CoCreateGuid.OLE32(?), ref: 00638FC8
                                                                                                                                                                  • Part of subcall function 00638FB0: StringFromCLSID.OLE32(?,?), ref: 00638FE0
                                                                                                                                                                  • Part of subcall function 00638FB0: CoTaskMemFree.OLE32(?), ref: 00639138
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 006393D1
                                                                                                                                                                  • Part of subcall function 00629BB0: InitOnceBeginInitialize.KERNEL32(007180C4,00000000,D8276B9A,00000000,D8276B9A,0062A219,007180CC,?,?,?,?,?,?,0062A219,?,?), ref: 00629BE5
                                                                                                                                                                  • Part of subcall function 00629BB0: InitOnceComplete.KERNEL32(007180C4,00000000,00000000), ref: 00629C1D
                                                                                                                                                                  • Part of subcall function 00629940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00629A12
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: InitIos_base_dtorOncestd::ios_base::_$BeginCompleteCreateFreeFromGuidInitializeStringTask
                                                                                                                                                                • String ID: Could not set registry value $Could not set registry value InstallerFlags$Failed to create new UUID$InstallerFlags$UUID$]
                                                                                                                                                                • API String ID: 598746661-2174109026
                                                                                                                                                                • Opcode ID: 6f5fe64e8048a220e745e4bfb140f90c7dcdfcbf19359aaf7aceeaf67e188819
                                                                                                                                                                • Instruction ID: 91f41ecae58817f5b0c2de2812987d235a0d38be01be0baa35646a7d0e6ac729
                                                                                                                                                                • Opcode Fuzzy Hash: 6f5fe64e8048a220e745e4bfb140f90c7dcdfcbf19359aaf7aceeaf67e188819
                                                                                                                                                                • Instruction Fuzzy Hash: 7551B070A00618DADF14EF60E892BEE77B6EF51310F50805CE90957281EBB4AA48CFA5
                                                                                                                                                                Function 00635790 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetProcAddress.KERNEL32(?,NotComDllGetInterface), ref: 00635808
                                                                                                                                                                • FreeLibrary.KERNEL32(?), ref: 00635828
                                                                                                                                                                • GetLastError.KERNEL32 ref: 00635830
                                                                                                                                                                • FreeLibrary.KERNEL32(?), ref: 00635839
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FreeLibrary$AddressErrorLastProc
                                                                                                                                                                • String ID: NotComDllGetInterface$mfeaaca.dll
                                                                                                                                                                • API String ID: 1092183831-2777911605
                                                                                                                                                                • Opcode ID: 07c2d13f398dc70a2a2e62ffdc5f7ea02bc27a5c056206ec8f99548cb6939b28
                                                                                                                                                                • Instruction ID: b6b202f57604064cfb8219a212cc5c6aad6eb7af65795ea7828772642746de0d
                                                                                                                                                                • Opcode Fuzzy Hash: 07c2d13f398dc70a2a2e62ffdc5f7ea02bc27a5c056206ec8f99548cb6939b28
                                                                                                                                                                • Instruction Fuzzy Hash: B421F232E016298BDB11AFA8DC446BEBBBAFF51350F05016AED02E7300EB718D048BD1
                                                                                                                                                                Function 00624D63 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 55synchronizationCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00624C8E: GetCurrentProcessId.KERNEL32 ref: 00624CA6
                                                                                                                                                                  • Part of subcall function 00624C8E: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00624CB8
                                                                                                                                                                  • Part of subcall function 00624C8E: Process32FirstW.KERNEL32(00000000,?), ref: 00624CD3
                                                                                                                                                                  • Part of subcall function 00624C8E: Process32NextW.KERNEL32(00000000,0000022C), ref: 00624CE9
                                                                                                                                                                  • Part of subcall function 00624C8E: FindCloseChangeNotification.KERNEL32(00000000), ref: 00624CFA
                                                                                                                                                                • CreateMutexW.KERNEL32(00000000,00000000,Global\{48ca68e-e4ff-43ac-a993-6d162f33de7c}), ref: 00624D88
                                                                                                                                                                • GetLastError.KERNEL32 ref: 00624DD0
                                                                                                                                                                  • Part of subcall function 0062136C: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 006213A5
                                                                                                                                                                • WaitForSingleObject.KERNEL32(00000000,0000EA60), ref: 00624DFC
                                                                                                                                                                • CloseHandle.KERNEL32 ref: 00624E0D
                                                                                                                                                                  • Part of subcall function 00629BB0: InitOnceBeginInitialize.KERNEL32(007180C4,00000000,D8276B9A,00000000,D8276B9A,0062A219,007180CC,?,?,?,?,?,?,0062A219,?,?), ref: 00629BE5
                                                                                                                                                                  • Part of subcall function 00629BB0: InitOnceComplete.KERNEL32(007180C4,00000000,00000000), ref: 00629C1D
                                                                                                                                                                  • Part of subcall function 00629940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00629A12
                                                                                                                                                                Strings
                                                                                                                                                                • SaBsi.cpp, xrefs: 00624DA9
                                                                                                                                                                • Global\{48ca68e-e4ff-43ac-a993-6d162f33de7c}, xrefs: 00624D7F
                                                                                                                                                                • CreateMutex failed: , xrefs: 00624DC2
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseCreateInitIos_base_dtorOnceProcess32std::ios_base::_$BeginChangeCompleteCurrentErrorFindFirstHandleInitializeLastMutexNextNotificationObjectProcessSingleSnapshotToolhelp32Wait
                                                                                                                                                                • String ID: CreateMutex failed: $Global\{48ca68e-e4ff-43ac-a993-6d162f33de7c}$SaBsi.cpp
                                                                                                                                                                • API String ID: 2189495138-1117126455
                                                                                                                                                                • Opcode ID: 2b090741bb38811baa51a62544edd34e77ab425fe71da02b7c8e976a5bbf5854
                                                                                                                                                                • Instruction ID: 7971be2d93ede753e8eacaae4a3cff1a86c7c0cc28f9f5a7d6855bd2a71b72c3
                                                                                                                                                                • Opcode Fuzzy Hash: 2b090741bb38811baa51a62544edd34e77ab425fe71da02b7c8e976a5bbf5854
                                                                                                                                                                • Instruction Fuzzy Hash: 9E11C1302187529BD720EF60E845BAA77A6BF50301F010C1DF8D54B1D1EF709448CE66
                                                                                                                                                                Function 0065E580 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 131COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                • NWebAdvisor::XMLParser::ParseBuffer, xrefs: 0065E5AA, 0065E6C3
                                                                                                                                                                • Unable to convert XML buffer into wide characters, xrefs: 0065E6BC
                                                                                                                                                                • invalid input, xrefs: 0065E5A3
                                                                                                                                                                • c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\XMLParser.cpp, xrefs: 0065E5AF, 0065E6C8
                                                                                                                                                                • ae, xrefs: 0065E6A0
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: __cftoe
                                                                                                                                                                • String ID: NWebAdvisor::XMLParser::ParseBuffer$Unable to convert XML buffer into wide characters$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\XMLParser.cpp$invalid input$ae
                                                                                                                                                                • API String ID: 4189289331-1760761867
                                                                                                                                                                • Opcode ID: 2d9497ac926b2c4407a9b6c32b69a357ae35d3b9581395da8f6766bd65dadeb7
                                                                                                                                                                • Instruction ID: c651a7abad867fb62bdae34088913956bb1e27f9cf35aa46c194106738ccc8b9
                                                                                                                                                                • Opcode Fuzzy Hash: 2d9497ac926b2c4407a9b6c32b69a357ae35d3b9581395da8f6766bd65dadeb7
                                                                                                                                                                • Instruction Fuzzy Hash: A341E6B1A01305AFCB64DF64D842BAFF7E5BF18700F41452DE84A97781DF75AA088794
                                                                                                                                                                Function 0063CCB0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 85COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00629BB0: InitOnceBeginInitialize.KERNEL32(007180C4,00000000,D8276B9A,00000000,D8276B9A,0062A219,007180CC,?,?,?,?,?,?,0062A219,?,?), ref: 00629BE5
                                                                                                                                                                  • Part of subcall function 00629BB0: InitOnceComplete.KERNEL32(007180C4,00000000,00000000), ref: 00629C1D
                                                                                                                                                                  • Part of subcall function 00629940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00629A12
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0063CDBB
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: InitIos_base_dtorOncestd::ios_base::_$BeginCompleteInitialize
                                                                                                                                                                • String ID: 5$AdhocAWSQAMode$Querying AdhocAWSQAMode value failed: $SOFTWARE\McAfee\WebAdvisor$`o
                                                                                                                                                                • API String ID: 539357862-554727154
                                                                                                                                                                • Opcode ID: 7a5cfdc7cffaeaf46c0b800afba6ebb8f4bf863315ac6b729b6839284b7f85c2
                                                                                                                                                                • Instruction ID: 8282d25ced642f333717c3ca9e4d628a94366b17d26f15ad47366f2c354f10bb
                                                                                                                                                                • Opcode Fuzzy Hash: 7a5cfdc7cffaeaf46c0b800afba6ebb8f4bf863315ac6b729b6839284b7f85c2
                                                                                                                                                                • Instruction Fuzzy Hash: C8317C71D0025D9ADB10EFA0C852BEEBBBAFF18304F50456DE506B3281EB745A08CFA5
                                                                                                                                                                Function 00625A4F Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 81COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __EH_prolog3_GS.LIBCMT ref: 00625A59
                                                                                                                                                                  • Part of subcall function 00625C1E: CoCreateInstance.OLE32(006ED808,00000000,00000017,006FB024,00000000,D8276B9A,?,?,?,00000000,00000000,00000000,006C8687,000000FF), ref: 00625C7A
                                                                                                                                                                  • Part of subcall function 00625C1E: OleRun.OLE32(00000000), ref: 00625C89
                                                                                                                                                                  • Part of subcall function 00629BB0: InitOnceBeginInitialize.KERNEL32(007180C4,00000000,D8276B9A,00000000,D8276B9A,0062A219,007180CC,?,?,?,?,?,?,0062A219,?,?), ref: 00629BE5
                                                                                                                                                                  • Part of subcall function 00629BB0: InitOnceComplete.KERNEL32(007180C4,00000000,00000000), ref: 00629C1D
                                                                                                                                                                  • Part of subcall function 00629940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00629A12
                                                                                                                                                                • _com_issue_error.COMSUPP ref: 00625B97
                                                                                                                                                                Strings
                                                                                                                                                                • Failed to create Global Options object. Error , xrefs: 00625AA9
                                                                                                                                                                • Failed to set new option. Error , xrefs: 00625B26
                                                                                                                                                                • i, xrefs: 00625B5D
                                                                                                                                                                • Activation option is set successfuly, xrefs: 00625B69
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: InitOnce$BeginCompleteCreateH_prolog3_InitializeInstanceIos_base_dtor_com_issue_errorstd::ios_base::_
                                                                                                                                                                • String ID: Activation option is set successfuly$Failed to create Global Options object. Error $Failed to set new option. Error $i
                                                                                                                                                                • API String ID: 1362393928-3233122435
                                                                                                                                                                • Opcode ID: 0ec3a310afa24842caffc3096e0e1a24f4d2ad724653d25593c5417ca476f279
                                                                                                                                                                • Instruction ID: 8bfa087319f3caa3b14d88f71c64426bca5799e6d29cbcd96a8330e09fbc2860
                                                                                                                                                                • Opcode Fuzzy Hash: 0ec3a310afa24842caffc3096e0e1a24f4d2ad724653d25593c5417ca476f279
                                                                                                                                                                • Instruction Fuzzy Hash: 4431AE70E00A298BDF54EBA0EC62BFDB776BF54301F40459CE5056B281EB706A45CFA5
                                                                                                                                                                Function 00644B40 Relevance: 9.3, APIs: 2, Strings: 3, Instructions: 562COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 00645182
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0064521E
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Concurrency::cancel_current_taskIos_base_dtorstd::ios_base::_
                                                                                                                                                                • String ID: 8o$Invalid arguements passed to AddDimension$N
                                                                                                                                                                • API String ID: 4106036149-2584000870
                                                                                                                                                                • Opcode ID: 244f614e8718477e64b4e71b5731129a8b0ff981bf0ccfe9a57290a4b8487433
                                                                                                                                                                • Instruction ID: 06b61667d90fbf1f1772b3f4b972758c7b73fd6c06b519fbbb245739e78b52bb
                                                                                                                                                                • Opcode Fuzzy Hash: 244f614e8718477e64b4e71b5731129a8b0ff981bf0ccfe9a57290a4b8487433
                                                                                                                                                                • Instruction Fuzzy Hash: 8532CC70D00258DFDB24CF64C845BAEBBF2BF45304F14829DE459AB792DB75AA84CB81
                                                                                                                                                                Function 006A22D9 Relevance: 9.3, APIs: 6, Instructions: 264COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __allrem.LIBCMT ref: 006A2461
                                                                                                                                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 006A247D
                                                                                                                                                                • __allrem.LIBCMT ref: 006A2494
                                                                                                                                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 006A24B2
                                                                                                                                                                • __allrem.LIBCMT ref: 006A24C9
                                                                                                                                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 006A24E7
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1992179935-0
                                                                                                                                                                • Opcode ID: f5f3a44ed8043a2ffd9b201dc5f07ecf71a3fa8d4abf09d185f58aaaf2be2bd1
                                                                                                                                                                • Instruction ID: 7bcd68d82bb5ea4e107cf21997b2029ab79adc496925396bef87fc088e869c0d
                                                                                                                                                                • Opcode Fuzzy Hash: f5f3a44ed8043a2ffd9b201dc5f07ecf71a3fa8d4abf09d185f58aaaf2be2bd1
                                                                                                                                                                • Instruction Fuzzy Hash: D681C2B1A407069BEB20AF6CCC91BAAB3EBAF46720F24412DE415D6781E774DE418F54
                                                                                                                                                                Function 00658650 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 337COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • std::locale::_Init.LIBCPMT ref: 0065882F
                                                                                                                                                                Strings
                                                                                                                                                                • c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\XmlUpdaterLogger.cpp, xrefs: 00658AF6
                                                                                                                                                                • *n, xrefs: 006589A7
                                                                                                                                                                • Failed to create log message string. Error 0x, xrefs: 006589CF
                                                                                                                                                                • $+n, xrefs: 006587F3
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Initstd::locale::_
                                                                                                                                                                • String ID: $+n$Failed to create log message string. Error 0x$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\XmlUpdaterLogger.cpp$*n
                                                                                                                                                                • API String ID: 1620887387-3591491335
                                                                                                                                                                • Opcode ID: 61df9218a3254564fef11b675d652da6a8e4aec2c4ee297d736e8b43e2d874e4
                                                                                                                                                                • Instruction ID: 79fe762b5cf83805d4d9bcaaa8bcc135ebc971645c59e947faa36dbb1c6933a2
                                                                                                                                                                • Opcode Fuzzy Hash: 61df9218a3254564fef11b675d652da6a8e4aec2c4ee297d736e8b43e2d874e4
                                                                                                                                                                • Instruction Fuzzy Hash: F0E13C70A00259CFDB24CF58C855BDDB7B6BF48304F1481A9E909BB780DB759A85CF50
                                                                                                                                                                Function 006307C0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __Mtx_destroy_in_situ.LIBCPMT ref: 0063085F
                                                                                                                                                                • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA),00000001,?,00000000), ref: 00630903
                                                                                                                                                                • LocalFree.KERNEL32(?,?), ref: 00630A26
                                                                                                                                                                • __Mtx_unlock.LIBCPMT ref: 00631020
                                                                                                                                                                Strings
                                                                                                                                                                • D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA), xrefs: 006308FE
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: DescriptorSecurity$ConvertFreeLocalMtx_destroy_in_situMtx_unlockString
                                                                                                                                                                • String ID: D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA)
                                                                                                                                                                • API String ID: 4147401711-3078421892
                                                                                                                                                                • Opcode ID: f7126ba725841f8d5006827b07fa6963e6113f5f60a93e2a9e158a99f38e8e8d
                                                                                                                                                                • Instruction ID: 5291e749bb30fdad5a67cd49011324b8a69bd82b8908755c74abe505e190183b
                                                                                                                                                                • Opcode Fuzzy Hash: f7126ba725841f8d5006827b07fa6963e6113f5f60a93e2a9e158a99f38e8e8d
                                                                                                                                                                • Instruction Fuzzy Hash: 026124719002548FEB18DF68CC95BEEB7B6EF45304F0041ADE4499BB91DB74AA88CB94
                                                                                                                                                                Function 00627F60 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __Xtime_get_ticks.LIBCPMT ref: 00627FAA
                                                                                                                                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00627FBC
                                                                                                                                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00627FD0
                                                                                                                                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00627FE2
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$Xtime_get_ticks
                                                                                                                                                                • String ID: [%Y%m%d %H:%M:%S.
                                                                                                                                                                • API String ID: 3638035285-2843400524
                                                                                                                                                                • Opcode ID: 71392c5ce58f7243f11fff6cf444f389e5d6250ae733f6486bed344d9d2d85d7
                                                                                                                                                                • Instruction ID: 336459baf0bb22234ac689b74255cfd0ee6fd43d8a9bd8ac79a5bfaebbcb02d8
                                                                                                                                                                • Opcode Fuzzy Hash: 71392c5ce58f7243f11fff6cf444f389e5d6250ae733f6486bed344d9d2d85d7
                                                                                                                                                                • Instruction Fuzzy Hash: 6E319171E006189FDB50DFA4CC46FAEB7BAEB44B10F04422DF504AB381DB7469048B94
                                                                                                                                                                Function 006C4DB0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 352COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID: %s%s$%s\%s$\\?\
                                                                                                                                                                • API String ID: 0-2843747179
                                                                                                                                                                • Opcode ID: f71feb9f406fe8634a51120eff77dca4d1203b937096d007bcfcbe73ae04d75a
                                                                                                                                                                • Instruction ID: 56050f65b5a5448bffb318397253fa5009440b1e11a9558183eecb8e86c93f6f
                                                                                                                                                                • Opcode Fuzzy Hash: f71feb9f406fe8634a51120eff77dca4d1203b937096d007bcfcbe73ae04d75a
                                                                                                                                                                • Instruction Fuzzy Hash: 8DD19D71D006189FCF10DFA4CC95BEEB7BAEF49314F540529E816AB241EB34AA45CBA1
                                                                                                                                                                Function 006639A0 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 270registryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\WATesting,00000000,00000001,?,D8276B9A,00000000,00000001), ref: 006639FC
                                                                                                                                                                  • Part of subcall function 00662820: RegQueryInfoKeyW.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00000000,D8276B9A,?,?,?), ref: 006628AC
                                                                                                                                                                • RegCloseKey.ADVAPI32(00000000,?,00000000,811C9DC5,path,00000004,?), ref: 00663D36
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseInfoOpenQuery
                                                                                                                                                                • String ID: SOFTWARE\WATesting$path
                                                                                                                                                                • API String ID: 2142960691-1550987622
                                                                                                                                                                • Opcode ID: a860a49eff6d06b17952061d3d84305a14c3accb9584095087729a20a7cbbc5c
                                                                                                                                                                • Instruction ID: a7e66ceea9f4dc0728d002082c054d66e577bcec54d7bdb81b6df1fb298ad92b
                                                                                                                                                                • Opcode Fuzzy Hash: a860a49eff6d06b17952061d3d84305a14c3accb9584095087729a20a7cbbc5c
                                                                                                                                                                • Instruction Fuzzy Hash: 8EB1A071A00668DFCB24DB64DC49BDEBBBAAF55304F1401D9E409AB391DB74AB88CF50
                                                                                                                                                                Function 0065FBE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 80COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetFileAttributesW.KERNEL32(?,006FBFD0,00000000,006FBFD0,00000000,?,0000001C,00000001,00000000,0000001C,?,?,00000014,006FBFD0,00000000,D8276B9A), ref: 0065FC1D
                                                                                                                                                                Strings
                                                                                                                                                                • NWebAdvisor::NHttp::NDownloadFile::StoreOnDisk, xrefs: 0065FC99
                                                                                                                                                                • Destination directory does not exist, xrefs: 0065FC8F
                                                                                                                                                                • c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\HttpsDownloadFile.cpp, xrefs: 0065FC9E
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AttributesFile
                                                                                                                                                                • String ID: Destination directory does not exist$NWebAdvisor::NHttp::NDownloadFile::StoreOnDisk$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\HttpsDownloadFile.cpp
                                                                                                                                                                • API String ID: 3188754299-3555079292
                                                                                                                                                                • Opcode ID: a0ab0db6550472f2fdf8ad50558b94ee4b84ffb4cb4310b7011e033d8ea99305
                                                                                                                                                                • Instruction ID: 6aafd6aa97cabe75c481a2d066826dd215eed5932da137d51f0828f50722c57d
                                                                                                                                                                • Opcode Fuzzy Hash: a0ab0db6550472f2fdf8ad50558b94ee4b84ffb4cb4310b7011e033d8ea99305
                                                                                                                                                                • Instruction Fuzzy Hash: 85212B75E0121CAFCF00DFA8D842AEEB7F6AB58714F11426AFC05B7281DB749A45CB94
                                                                                                                                                                Function 0064CC20 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 79COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00629BB0: InitOnceBeginInitialize.KERNEL32(007180C4,00000000,D8276B9A,00000000,D8276B9A,0062A219,007180CC,?,?,?,?,?,?,0062A219,?,?), ref: 00629BE5
                                                                                                                                                                  • Part of subcall function 00629BB0: InitOnceComplete.KERNEL32(007180C4,00000000,00000000), ref: 00629C1D
                                                                                                                                                                  • Part of subcall function 00629940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00629A12
                                                                                                                                                                • GetLastError.KERNEL32(?,00000001), ref: 0064CCBB
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0064CCEC
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: InitIos_base_dtorOncestd::ios_base::_$BeginCompleteErrorInitializeLast
                                                                                                                                                                • String ID: Po$Unable to set proxy option, error:
                                                                                                                                                                • API String ID: 879576418-1046243221
                                                                                                                                                                • Opcode ID: e39ce765e2a1de2726bee43eebf3b8d3a11a8d34867a6c758a4be6793df1ef3f
                                                                                                                                                                • Instruction ID: cf5283bb59094bc87ff81a7f560a6411c31862d0ad23da07ab95886114f364e1
                                                                                                                                                                • Opcode Fuzzy Hash: e39ce765e2a1de2726bee43eebf3b8d3a11a8d34867a6c758a4be6793df1ef3f
                                                                                                                                                                • Instruction Fuzzy Hash: AA318D71A04319DFDB60DF64DC05BEEBBBAFB04710F00866DE815A7290EB756A04CB65
                                                                                                                                                                Function 0062DC20 Relevance: 5.8, APIs: 2, Strings: 1, Instructions: 553COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Strings
                                                                                                                                                                • D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA), xrefs: 0062E367
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID: D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA)
                                                                                                                                                                • API String ID: 0-3078421892
                                                                                                                                                                • Opcode ID: 5900e5f06fe23c4276742c9ab075c88f075291509c9666eaba29a656c2f4b2ff
                                                                                                                                                                • Instruction ID: 52aba5d66a4e05a600eb1e55dc37daef2d39a49142841d6b33e7bf75a3d9c68b
                                                                                                                                                                • Opcode Fuzzy Hash: 5900e5f06fe23c4276742c9ab075c88f075291509c9666eaba29a656c2f4b2ff
                                                                                                                                                                • Instruction Fuzzy Hash: B3220371A00618DBCB14DF68EC89BEDB7B6FF44304F1046ADE409A7690DB75AA84CF94
                                                                                                                                                                Function 0062E310 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 206COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA),00000001,00000000,00000000), ref: 0062E36C
                                                                                                                                                                Strings
                                                                                                                                                                • D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA), xrefs: 0062E367
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: DescriptorSecurity$ConvertString
                                                                                                                                                                • String ID: D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA)
                                                                                                                                                                • API String ID: 3907675253-3078421892
                                                                                                                                                                • Opcode ID: f99369ef0d200d178cd899b18f43c5f1f87aa4ba96a8b06c1ea8001b2ad836b6
                                                                                                                                                                • Instruction ID: 5e4df32789e33c34f82392caa3980aebc4f627f83c8481e5b0df58ef5f8ba7f3
                                                                                                                                                                • Opcode Fuzzy Hash: f99369ef0d200d178cd899b18f43c5f1f87aa4ba96a8b06c1ea8001b2ad836b6
                                                                                                                                                                • Instruction Fuzzy Hash: DD81C5309016699BDB24DF64DC8CBDDB7B6EF85304F1042D9E008A7691EB7AAB84CF54
                                                                                                                                                                Function 006B5FD8 Relevance: 4.7, APIs: 3, Instructions: 177fileCOMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 006B576D: GetConsoleCP.KERNEL32(?,0065860A,00000000), ref: 006B57B5
                                                                                                                                                                • WriteFile.KERNEL32(?,00000000,0070C218,D8276B9A,00000000,D8276B9A,0065860A,0065860A,0065860A,D8276B9A,00000000,?,006A591E,00000000,0070C218,00000010), ref: 006B6129
                                                                                                                                                                • GetLastError.KERNEL32(?,006A591E,00000000,0070C218,00000010,0065860A), ref: 006B6133
                                                                                                                                                                • __dosmaperr.LIBCMT ref: 006B6178
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ConsoleErrorFileLastWrite__dosmaperr
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 251514795-0
                                                                                                                                                                • Opcode ID: 13a6eb75213ee951b09e5f2636f8d43c4a214353f9acdad0431009bd1203e4ac
                                                                                                                                                                • Instruction ID: a49c12134343037ec6bb433108b6e4d7f33f1426eb3c56b0cadf6fb2be2d40db
                                                                                                                                                                • Opcode Fuzzy Hash: 13a6eb75213ee951b09e5f2636f8d43c4a214353f9acdad0431009bd1203e4ac
                                                                                                                                                                • Instruction Fuzzy Hash: A651C3B1A00209AFEF11AFA9CD45BEEBBBBEF05354F040055F500AB252D6799D818B60
                                                                                                                                                                Function 0062E640 Relevance: 4.6, APIs: 3, Instructions: 120COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetFileAttributesW.KERNEL32(00000000,D8276B9A,0000005C,?,?,?,?,00000000,006C952D,000000FF,?,0062E09D), ref: 0062E681
                                                                                                                                                                • CreateDirectoryW.KERNEL32(00000000,?,?,?,?,?,00000000,006C952D,000000FF,?,0062E09D), ref: 0062E738
                                                                                                                                                                • GetLastError.KERNEL32(?,?,?,?,00000000,006C952D,000000FF,?,0062E09D), ref: 0062E742
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AttributesCreateDirectoryErrorFileLast
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 674977465-0
                                                                                                                                                                • Opcode ID: cc1c5839cf60fa2a31e59affdb56a5ac69376cf4291155ae4b32315233e30928
                                                                                                                                                                • Instruction ID: 5dbe67ce250d60ddd875bd7cc1887911348e37df95a6f12919129ebd98036596
                                                                                                                                                                • Opcode Fuzzy Hash: cc1c5839cf60fa2a31e59affdb56a5ac69376cf4291155ae4b32315233e30928
                                                                                                                                                                • Instruction Fuzzy Hash: 3F31F631A00614DBDB14DF68E984BAEB7B6FF45714F10467EE40593B80D7366905CF94
                                                                                                                                                                Function 00681F70 Relevance: 4.6, APIs: 3, Instructions: 104encryptionCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CertGetCertificateChain.CRYPT32(00000000,?,?,?), ref: 0068206C
                                                                                                                                                                • CertVerifyCertificateChainPolicy.CRYPT32(00000003,?,?,?), ref: 006820A4
                                                                                                                                                                • CertFreeCertificateChain.CRYPT32(?), ref: 006820D0
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CertCertificateChain$FreePolicyVerify
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1741975133-0
                                                                                                                                                                • Opcode ID: 7aeb5f11f2a0774900739a0227b47a7549baa1b8ea8fee8bb8ca9907c89a67e7
                                                                                                                                                                • Instruction ID: 291231931b2c55e7cb790226efbf9afd6e671f794d8532eaddf54964a0690e31
                                                                                                                                                                • Opcode Fuzzy Hash: 7aeb5f11f2a0774900739a0227b47a7549baa1b8ea8fee8bb8ca9907c89a67e7
                                                                                                                                                                • Instruction Fuzzy Hash: 5F418DB16083869BD720CF54C8A4BDBBBE8FF89704F040A1DF58897250E776E548CB62
                                                                                                                                                                Function 006B6B6C Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • FindCloseChangeNotification.KERNEL32(00000000,00000000,0065860A,?,006B6A9A,0065860A,0070C5B8,0000000C,006B6B4C,0070C218), ref: 006B6BC2
                                                                                                                                                                • GetLastError.KERNEL32(?,006B6A9A,0065860A,0070C5B8,0000000C,006B6B4C,0070C218), ref: 006B6BCC
                                                                                                                                                                • __dosmaperr.LIBCMT ref: 006B6BF7
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ChangeCloseErrorFindLastNotification__dosmaperr
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 490808831-0
                                                                                                                                                                • Opcode ID: cd79ee4fd6644dc138efe2ac25bdc435eecc552ede7d19e75a854c4028c2000e
                                                                                                                                                                • Instruction ID: e549492c5c69631420f4339ebbef057911541f200525f5ae23042a90b962df5b
                                                                                                                                                                • Opcode Fuzzy Hash: cd79ee4fd6644dc138efe2ac25bdc435eecc552ede7d19e75a854c4028c2000e
                                                                                                                                                                • Instruction Fuzzy Hash: 910144B3A0916016C6246778EC45BFE2B6F9F82734F28425DF919CB2D2DA298CC18391
                                                                                                                                                                Function 006B68F6 Relevance: 4.5, APIs: 3, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SetFilePointerEx.KERNEL32(00000000,00000000,?,00000000,006BF765,00000008,00000000,?,?,?,006B69A3,00000000,00000000,?,006BF765), ref: 006B692F
                                                                                                                                                                • GetLastError.KERNEL32(?,?,?,006B69A3,00000000,00000000,?,006BF765,?,006BF765,?,00000000,00000000,00000001,?,00000008), ref: 006B6939
                                                                                                                                                                • __dosmaperr.LIBCMT ref: 006B6940
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorFileLastPointer__dosmaperr
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2336955059-0
                                                                                                                                                                • Opcode ID: eb59b2e5e1a18b6ec179b05eb2d0197effd80da1fadad1382cd8bc0a3ea38790
                                                                                                                                                                • Instruction ID: 9b30566e9fd8245c13904707573044a34ce9e78580013e110408f60d8fde2db5
                                                                                                                                                                • Opcode Fuzzy Hash: eb59b2e5e1a18b6ec179b05eb2d0197effd80da1fadad1382cd8bc0a3ea38790
                                                                                                                                                                • Instruction Fuzzy Hash: CF01FC72610515BFCF05AF99DC458EE3B2FEB853207240209F4119B2D0EA75DD428B90
                                                                                                                                                                Function 00674C69 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ___delayLoadHelper2@8.DELAYIMP ref: 00674C81
                                                                                                                                                                  • Part of subcall function 0068293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006829AF
                                                                                                                                                                  • Part of subcall function 0068293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006829C0
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                • String ID: yt
                                                                                                                                                                • API String ID: 1269201914-4251244651
                                                                                                                                                                • Opcode ID: 93c260a492f05940b612d283582c5c07e5d4ec42835f5e8b035cc8786663fc20
                                                                                                                                                                • Instruction ID: 91bcc08a27f89d5ae6bc8a07b1cb30507292b4ed92b7db275573d2ef3c12f4cb
                                                                                                                                                                • Opcode Fuzzy Hash: 93c260a492f05940b612d283582c5c07e5d4ec42835f5e8b035cc8786663fc20
                                                                                                                                                                • Instruction Fuzzy Hash: B6B012F525D202FD330522655D1EC77010EC5C1F10B30832EF804D00C0DD850C8600B2
                                                                                                                                                                Function 00674CEA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ___delayLoadHelper2@8.DELAYIMP ref: 00674C81
                                                                                                                                                                  • Part of subcall function 0068293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006829AF
                                                                                                                                                                  • Part of subcall function 0068293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006829C0
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                • String ID: yt
                                                                                                                                                                • API String ID: 1269201914-4251244651
                                                                                                                                                                • Opcode ID: ca358f05de870de9e8769fbedaccb39378c845133559dbe70fa6ae9c1a858314
                                                                                                                                                                • Instruction ID: cd43b449abad2e8dd363175382372474f42010740d915dfcae828d37815778ed
                                                                                                                                                                • Opcode Fuzzy Hash: ca358f05de870de9e8769fbedaccb39378c845133559dbe70fa6ae9c1a858314
                                                                                                                                                                • Instruction Fuzzy Hash: 9EB012E525D102FD334562595E1AD37014EC1C5F10B31C22EF509C01C0DD850D430132
                                                                                                                                                                Function 00674CFA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ___delayLoadHelper2@8.DELAYIMP ref: 00674C81
                                                                                                                                                                  • Part of subcall function 0068293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006829AF
                                                                                                                                                                  • Part of subcall function 0068293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006829C0
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                • String ID: yt
                                                                                                                                                                • API String ID: 1269201914-4251244651
                                                                                                                                                                • Opcode ID: 154bb730a3d2d379c7c309bfd486a68f9d62336a5111954bc8b91c7528042b46
                                                                                                                                                                • Instruction ID: 6e9da521fc1d12453b3003e727abf91b959b1cc8b846b7317f89e2e542319486
                                                                                                                                                                • Opcode Fuzzy Hash: 154bb730a3d2d379c7c309bfd486a68f9d62336a5111954bc8b91c7528042b46
                                                                                                                                                                • Instruction Fuzzy Hash: A0B012E525D102FD3245A2595D1AE37015ED1C5B10B30822EF409C01C0DD840C424132
                                                                                                                                                                Function 00674CCA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ___delayLoadHelper2@8.DELAYIMP ref: 00674C81
                                                                                                                                                                  • Part of subcall function 0068293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006829AF
                                                                                                                                                                  • Part of subcall function 0068293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006829C0
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                • String ID: yt
                                                                                                                                                                • API String ID: 1269201914-4251244651
                                                                                                                                                                • Opcode ID: 777bfaf307d778dd167d651350cc4bf3a6810503c30961f8cdba290ded8f2292
                                                                                                                                                                • Instruction ID: 9606614a4204e70a3aac8772d4881510ba06c25d72622d7c5770898413000274
                                                                                                                                                                • Opcode Fuzzy Hash: 777bfaf307d778dd167d651350cc4bf3a6810503c30961f8cdba290ded8f2292
                                                                                                                                                                • Instruction Fuzzy Hash: F6B012E525D102FD3645625D5D1AD37014EC1C5B10B30C22EF809C01C0DDC40C420132
                                                                                                                                                                Function 00674CDA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ___delayLoadHelper2@8.DELAYIMP ref: 00674C81
                                                                                                                                                                  • Part of subcall function 0068293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006829AF
                                                                                                                                                                  • Part of subcall function 0068293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006829C0
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                • String ID: yt
                                                                                                                                                                • API String ID: 1269201914-4251244651
                                                                                                                                                                • Opcode ID: fe8b2cde0101bab2ba6404532f672d9e41cbc5abb82ada69a205e9276412f218
                                                                                                                                                                • Instruction ID: fb8f68013e3ccd4965b1de6e985fe30e52259c431678f42ca15d575b8fb25be2
                                                                                                                                                                • Opcode Fuzzy Hash: fe8b2cde0101bab2ba6404532f672d9e41cbc5abb82ada69a205e9276412f218
                                                                                                                                                                • Instruction Fuzzy Hash: 64B012E525D202FD334562595D1AD77014EC1C5B10F30832EF809C01D0DD840D860133
                                                                                                                                                                Function 00674CAA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ___delayLoadHelper2@8.DELAYIMP ref: 00674C81
                                                                                                                                                                  • Part of subcall function 0068293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006829AF
                                                                                                                                                                  • Part of subcall function 0068293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006829C0
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                • String ID: yt
                                                                                                                                                                • API String ID: 1269201914-4251244651
                                                                                                                                                                • Opcode ID: 96984de022ab0c08c3bebcfe954056b8b7609059c5355914cfbe187412737644
                                                                                                                                                                • Instruction ID: ba5a920ddf7b0218d8a84aa41acf5eb283e2afa69c7c311075b18979bd6f18a1
                                                                                                                                                                • Opcode Fuzzy Hash: 96984de022ab0c08c3bebcfe954056b8b7609059c5355914cfbe187412737644
                                                                                                                                                                • Instruction Fuzzy Hash: 3BB012E126D102BD334562595D1AC37014ED1C5F10B31C26EF608C11C0DD850C430131
                                                                                                                                                                Function 00674CBA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ___delayLoadHelper2@8.DELAYIMP ref: 00674C81
                                                                                                                                                                  • Part of subcall function 0068293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006829AF
                                                                                                                                                                  • Part of subcall function 0068293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006829C0
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                • String ID: yt
                                                                                                                                                                • API String ID: 1269201914-4251244651
                                                                                                                                                                • Opcode ID: fcae0ad750c1ed5de5ad3d6e7c09848b7e40bce9692e33f2e271f110f932f3f7
                                                                                                                                                                • Instruction ID: 861a432e1fc8e4e6bb6affa12bf84fb6ddf1af7d89c64e6cf2da32459e1e6f1c
                                                                                                                                                                • Opcode Fuzzy Hash: fcae0ad750c1ed5de5ad3d6e7c09848b7e40bce9692e33f2e271f110f932f3f7
                                                                                                                                                                • Instruction Fuzzy Hash: A8B012E125D102FD364562595C1AC37014EC5C5F10B31C22EF808C01C0DD850C420171
                                                                                                                                                                Function 00674C8A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ___delayLoadHelper2@8.DELAYIMP ref: 00674C81
                                                                                                                                                                  • Part of subcall function 0068293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006829AF
                                                                                                                                                                  • Part of subcall function 0068293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006829C0
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                • String ID: yt
                                                                                                                                                                • API String ID: 1269201914-4251244651
                                                                                                                                                                • Opcode ID: 48cc102a7e5e552483f7705bff70f74074eedb5a7f6d9c976ae60f24a26ffca9
                                                                                                                                                                • Instruction ID: dec67e36c67120182363c6b1d400045ec55bf5aa1c8e1e9a4e83e84ff250ad81
                                                                                                                                                                • Opcode Fuzzy Hash: 48cc102a7e5e552483f7705bff70f74074eedb5a7f6d9c976ae60f24a26ffca9
                                                                                                                                                                • Instruction Fuzzy Hash: E6B012E126D103FD364562599C1AC37014EC1C5B10B30C66EF908C11C0DD840C420131
                                                                                                                                                                Function 00674C9A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ___delayLoadHelper2@8.DELAYIMP ref: 00674C81
                                                                                                                                                                  • Part of subcall function 0068293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006829AF
                                                                                                                                                                  • Part of subcall function 0068293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006829C0
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                • String ID: yt
                                                                                                                                                                • API String ID: 1269201914-4251244651
                                                                                                                                                                • Opcode ID: 15bf7f7c08e589ef871e18089e6a5b99b7d32dd423f5ee9f618551e9f24329dd
                                                                                                                                                                • Instruction ID: 81c1ec2c71baad81ae6ef4e448dad40cca9e8222987cae58f1d7186f5c7e9855
                                                                                                                                                                • Opcode Fuzzy Hash: 15bf7f7c08e589ef871e18089e6a5b99b7d32dd423f5ee9f618551e9f24329dd
                                                                                                                                                                • Instruction Fuzzy Hash: 3DB012E126D202BD334562595C1AC77014EC1C5B20B30836EF908C11C0DD840C860136
                                                                                                                                                                Function 00674D61 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ___delayLoadHelper2@8.DELAYIMP ref: 00674D1C
                                                                                                                                                                  • Part of subcall function 0068293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006829AF
                                                                                                                                                                  • Part of subcall function 0068293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006829C0
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                • String ID: `avo
                                                                                                                                                                • API String ID: 1269201914-4146015153
                                                                                                                                                                • Opcode ID: 91313040860ce9fe027dc1130375a4f191a9861dff4e4acc19461f88a986a9af
                                                                                                                                                                • Instruction ID: b5448a1ba0424181ce003b440025d9445af77c1ecb64f42d82fadde8534730f4
                                                                                                                                                                • Opcode Fuzzy Hash: 91313040860ce9fe027dc1130375a4f191a9861dff4e4acc19461f88a986a9af
                                                                                                                                                                • Instruction Fuzzy Hash: E8B012E1798302FC3A54624D9C1EC37025EC5C4B10331C22EFD08C02C0ED480C425131
                                                                                                                                                                Function 00674D6B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ___delayLoadHelper2@8.DELAYIMP ref: 00674D1C
                                                                                                                                                                  • Part of subcall function 0068293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006829AF
                                                                                                                                                                  • Part of subcall function 0068293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006829C0
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                • String ID: `avo
                                                                                                                                                                • API String ID: 1269201914-4146015153
                                                                                                                                                                • Opcode ID: 66a1ff4db983ba9d8c815c8a7f5021356b0b680b04f994acfdba7b9e832da710
                                                                                                                                                                • Instruction ID: 2a51639ed546fa1a131fa9d2b8a8c9be1d900b55cce0b45ec0f340a6b325ae82
                                                                                                                                                                • Opcode Fuzzy Hash: 66a1ff4db983ba9d8c815c8a7f5021356b0b680b04f994acfdba7b9e832da710
                                                                                                                                                                • Instruction Fuzzy Hash: 03B012E1398302FC3754624DAC1FC77025EC5C4B10331832EFC08C02C0EC480C865132
                                                                                                                                                                Function 00674D75 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ___delayLoadHelper2@8.DELAYIMP ref: 00674D1C
                                                                                                                                                                  • Part of subcall function 0068293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006829AF
                                                                                                                                                                  • Part of subcall function 0068293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006829C0
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                • String ID: `avo
                                                                                                                                                                • API String ID: 1269201914-4146015153
                                                                                                                                                                • Opcode ID: 5252c230447d5841bbac5e7c971de5ee0ca73d342f3b887f8297ad68f1ce1753
                                                                                                                                                                • Instruction ID: 570d6b3d4f00369175d717ac6edb5cdd8ec606aacdea369ff4e131dc3b497c9e
                                                                                                                                                                • Opcode Fuzzy Hash: 5252c230447d5841bbac5e7c971de5ee0ca73d342f3b887f8297ad68f1ce1753
                                                                                                                                                                • Instruction Fuzzy Hash: 9AB012E1298202FC3A54624D9C1EC37026EC5C4B10331C32EFD08C02C0EC480C465131
                                                                                                                                                                Function 00674D7F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ___delayLoadHelper2@8.DELAYIMP ref: 00674D1C
                                                                                                                                                                  • Part of subcall function 0068293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006829AF
                                                                                                                                                                  • Part of subcall function 0068293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006829C0
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                • String ID: `avo
                                                                                                                                                                • API String ID: 1269201914-4146015153
                                                                                                                                                                • Opcode ID: ea8f8c7882ec6a05ee56289e0e874f77e83992835e9957e1cb577a558bd963a8
                                                                                                                                                                • Instruction ID: 3d7f722cf18a807c4e953f85ed70cdcd393083ef8a6b0fe5b72e85a64231f143
                                                                                                                                                                • Opcode Fuzzy Hash: ea8f8c7882ec6a05ee56289e0e874f77e83992835e9957e1cb577a558bd963a8
                                                                                                                                                                • Instruction Fuzzy Hash: FAB012E13D8306FC3654A24E9C1ED37027ED5C4B10331822EF808C02C0ED480C429231
                                                                                                                                                                Function 00674D43 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ___delayLoadHelper2@8.DELAYIMP ref: 00674D1C
                                                                                                                                                                  • Part of subcall function 0068293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006829AF
                                                                                                                                                                  • Part of subcall function 0068293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006829C0
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                • String ID: `avo
                                                                                                                                                                • API String ID: 1269201914-4146015153
                                                                                                                                                                • Opcode ID: 6c98f7c79730c1548b4c7323af52acdcf5bba70bde6e2f6fbc83b29b41becb59
                                                                                                                                                                • Instruction ID: 8e68f7cc634964465fccd855d30fa6244361985fe849111fb90d85bd3fabf38e
                                                                                                                                                                • Opcode Fuzzy Hash: 6c98f7c79730c1548b4c7323af52acdcf5bba70bde6e2f6fbc83b29b41becb59
                                                                                                                                                                • Instruction Fuzzy Hash: FAB092A1298202AC26586249991A837025AC584B20372832AF949C0280E8484C425135
                                                                                                                                                                Function 00674D4D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ___delayLoadHelper2@8.DELAYIMP ref: 00674D1C
                                                                                                                                                                  • Part of subcall function 0068293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006829AF
                                                                                                                                                                  • Part of subcall function 0068293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006829C0
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                • String ID: `avo
                                                                                                                                                                • API String ID: 1269201914-4146015153
                                                                                                                                                                • Opcode ID: c7db42a797b3e820ffb0efd633d14d05ab06dd64bf3916e1b860b9f53b28625d
                                                                                                                                                                • Instruction ID: 0a3ee5131db3c057218f024966375142b14fc72e3ce45104bb0e4abe551e271c
                                                                                                                                                                • Opcode Fuzzy Hash: c7db42a797b3e820ffb0efd633d14d05ab06dd64bf3916e1b860b9f53b28625d
                                                                                                                                                                • Instruction Fuzzy Hash: FAB012E1798202FC3B54624D9C1FC37026EC5C4B10331C22EFC08C12C4EC480C465131
                                                                                                                                                                Function 00674D57 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ___delayLoadHelper2@8.DELAYIMP ref: 00674D1C
                                                                                                                                                                  • Part of subcall function 0068293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006829AF
                                                                                                                                                                  • Part of subcall function 0068293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006829C0
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                • String ID: `avo
                                                                                                                                                                • API String ID: 1269201914-4146015153
                                                                                                                                                                • Opcode ID: a9e4fb9d97fc79b39d8bd4d9e9d70386b658530790473b082154cb7f01740104
                                                                                                                                                                • Instruction ID: 8d41a566f7b0229895bb7572d50ffd6498c5efec34d79c11f3d19a5931673c48
                                                                                                                                                                • Opcode Fuzzy Hash: a9e4fb9d97fc79b39d8bd4d9e9d70386b658530790473b082154cb7f01740104
                                                                                                                                                                • Instruction Fuzzy Hash: 14B012E52A8202FC3658A24DDC1ED37026ED5C4B20331832FF849C02C0EC484C429135
                                                                                                                                                                Function 00674D25 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ___delayLoadHelper2@8.DELAYIMP ref: 00674D1C
                                                                                                                                                                  • Part of subcall function 0068293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006829AF
                                                                                                                                                                  • Part of subcall function 0068293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006829C0
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                • String ID: `avo
                                                                                                                                                                • API String ID: 1269201914-4146015153
                                                                                                                                                                • Opcode ID: c54987d5c8d38ef8c6979801a5ac16da3aab70f5db23f044636173e29429f824
                                                                                                                                                                • Instruction ID: a7d0bdf3fe6f25c0be5d16ec1b5ac62ac4189d64e0ef0356436c1da080367ecd
                                                                                                                                                                • Opcode Fuzzy Hash: c54987d5c8d38ef8c6979801a5ac16da3aab70f5db23f044636173e29429f824
                                                                                                                                                                • Instruction Fuzzy Hash: C8B012E1398202FD3654A24D9C1FD77026ED5C4B10331822EF808C02C0EC480C429131
                                                                                                                                                                Function 00674D2F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ___delayLoadHelper2@8.DELAYIMP ref: 00674D1C
                                                                                                                                                                  • Part of subcall function 0068293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006829AF
                                                                                                                                                                  • Part of subcall function 0068293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006829C0
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                • String ID: `avo
                                                                                                                                                                • API String ID: 1269201914-4146015153
                                                                                                                                                                • Opcode ID: f41027efc2dd8ea1072c54527a855b1b655a015276d428e85c631a9be7fbc9de
                                                                                                                                                                • Instruction ID: e7886b80bb5f7d17276a4f966609abc950a7b832e44133c6fad506cc97c0cfa9
                                                                                                                                                                • Opcode Fuzzy Hash: f41027efc2dd8ea1072c54527a855b1b655a015276d428e85c631a9be7fbc9de
                                                                                                                                                                • Instruction Fuzzy Hash: BEB012E1298202FC3A58624DDC1EC37035EC5C8B20331C32EFC49C03C0EC484C425135
                                                                                                                                                                Function 00674D39 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ___delayLoadHelper2@8.DELAYIMP ref: 00674D1C
                                                                                                                                                                  • Part of subcall function 0068293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006829AF
                                                                                                                                                                  • Part of subcall function 0068293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006829C0
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                • String ID: `avo
                                                                                                                                                                • API String ID: 1269201914-4146015153
                                                                                                                                                                • Opcode ID: 2afe6ed0af6fbf9c68846fe7176b6d1d2650ac59eb55148a4b90b949beadf940
                                                                                                                                                                • Instruction ID: 8437f7a0f0650e468a245de06adafd3bc01cd96c6451d19739ae67779ba574af
                                                                                                                                                                • Opcode Fuzzy Hash: 2afe6ed0af6fbf9c68846fe7176b6d1d2650ac59eb55148a4b90b949beadf940
                                                                                                                                                                • Instruction Fuzzy Hash: 57B012E1298302FC3758624DDC1EC77025EC5C4B20331832EFC49C02C0EC484C865136
                                                                                                                                                                Function 00674D0A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ___delayLoadHelper2@8.DELAYIMP ref: 00674D1C
                                                                                                                                                                  • Part of subcall function 0068293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006829AF
                                                                                                                                                                  • Part of subcall function 0068293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006829C0
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                • String ID: `avo
                                                                                                                                                                • API String ID: 1269201914-4146015153
                                                                                                                                                                • Opcode ID: ad02c302d86702feaca2a8b5d17e2f5bc0498ba8bd672f7818d56e3ddcf4eba0
                                                                                                                                                                • Instruction ID: 899e77d85b0d67992770f813b0cc9d06754e5e4d1f1f05cb188b6b05ec6fc542
                                                                                                                                                                • Opcode Fuzzy Hash: ad02c302d86702feaca2a8b5d17e2f5bc0498ba8bd672f7818d56e3ddcf4eba0
                                                                                                                                                                • Instruction Fuzzy Hash: 8CB012E1398203FC371422499D1FC37021EC5C0F10332C22EF904C01C1EC480C435071
                                                                                                                                                                Function 00674D89 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ___delayLoadHelper2@8.DELAYIMP ref: 00674D1C
                                                                                                                                                                  • Part of subcall function 0068293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006829AF
                                                                                                                                                                  • Part of subcall function 0068293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006829C0
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                • String ID: `avo
                                                                                                                                                                • API String ID: 1269201914-4146015153
                                                                                                                                                                • Opcode ID: 7b163b0bb4586799649aafdab3ff95c27d73954aef9a5647c35e6183cf7ac67e
                                                                                                                                                                • Instruction ID: 45879848a020d8dac05dd14e16f1aa073c6c6d1a2c11479a4f0330f247ee0b2c
                                                                                                                                                                • Opcode Fuzzy Hash: 7b163b0bb4586799649aafdab3ff95c27d73954aef9a5647c35e6183cf7ac67e
                                                                                                                                                                • Instruction Fuzzy Hash: 1CB092A1298302AC26546249A91A837025EC584B10332822AF908C0280E9480C425131
                                                                                                                                                                Function 00674D93 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ___delayLoadHelper2@8.DELAYIMP ref: 00674D1C
                                                                                                                                                                  • Part of subcall function 0068293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006829AF
                                                                                                                                                                  • Part of subcall function 0068293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006829C0
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                • String ID: `avo
                                                                                                                                                                • API String ID: 1269201914-4146015153
                                                                                                                                                                • Opcode ID: de8065316f0ef882aef61e027e69c2fe49008714f669988904817cfece0dec6c
                                                                                                                                                                • Instruction ID: 3b8553a5ca133075fe79ff510327c31e61924a4074cd818499f8457f4bd3c846
                                                                                                                                                                • Opcode Fuzzy Hash: de8065316f0ef882aef61e027e69c2fe49008714f669988904817cfece0dec6c
                                                                                                                                                                • Instruction Fuzzy Hash: BFB012E1398302FC3B54624D9C1EC77025EC5C4B10331832EFC08C02C0ED480C869132
                                                                                                                                                                Function 00644A40 Relevance: 3.1, APIs: 2, Instructions: 90COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • _com_issue_error.COMSUPP ref: 00644AD2
                                                                                                                                                                • SysFreeString.OLEAUT32(-00000001), ref: 00644AFD
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FreeString_com_issue_error
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 709734423-0
                                                                                                                                                                • Opcode ID: 378fe54be8a085f1486948aa1d9d5a7b01303208d335055a0e3e525deba8d9dc
                                                                                                                                                                • Instruction ID: 4d6681a783ab7b00044a0796cc39abb87b586de91cdea0f2af744829b88d0e00
                                                                                                                                                                • Opcode Fuzzy Hash: 378fe54be8a085f1486948aa1d9d5a7b01303208d335055a0e3e525deba8d9dc
                                                                                                                                                                • Instruction Fuzzy Hash: 2021C4B1901715ABD7209F59C805B9AFBE9EF41B20F24472EF86597780EBB4E840C794
                                                                                                                                                                Function 006B5BF0 Relevance: 3.1, APIs: 2, Instructions: 80fileCOMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • WriteFile.KERNEL32(?,?,?,?,00000000,?,0065860A,00000000,?,006B610D,0065860A,0065860A,00000000,0070C218,D8276B9A,0065860A), ref: 006B5C8C
                                                                                                                                                                • GetLastError.KERNEL32(?,006B610D,0065860A,0065860A,00000000,0070C218,D8276B9A,0065860A,0065860A,0065860A,D8276B9A,00000000,?,006A591E,00000000,0070C218), ref: 006B5CB2
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorFileLastWrite
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 442123175-0
                                                                                                                                                                • Opcode ID: 5c69cfe7ef5e297ff0a9832bfdb1b7d09bc183904af4fc58d31ae87a78d61ed2
                                                                                                                                                                • Instruction ID: 4e6b8ceb41f3342c4977868b36d8e50a03c88d4427b2f5380bff394132decf99
                                                                                                                                                                • Opcode Fuzzy Hash: 5c69cfe7ef5e297ff0a9832bfdb1b7d09bc183904af4fc58d31ae87a78d61ed2
                                                                                                                                                                • Instruction Fuzzy Hash: A1217E70A002199FCF19DF19DC80AE9BBBBEB48301B1441ADE946D7211D7309E868B64
                                                                                                                                                                Function 00625C1E Relevance: 3.1, APIs: 2, Instructions: 76comCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CoCreateInstance.OLE32(006ED808,00000000,00000017,006FB024,00000000,D8276B9A,?,?,?,00000000,00000000,00000000,006C8687,000000FF), ref: 00625C7A
                                                                                                                                                                • OleRun.OLE32(00000000), ref: 00625C89
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateInstance
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 542301482-0
                                                                                                                                                                • Opcode ID: 326ab8635ccfe50bc88d90765f4c288e68393ea6ffcdc239e8bd96b11199929e
                                                                                                                                                                • Instruction ID: 695c6de7e1dd1a689c7f5ac97591a7a6520fce0f99eb14f45bb091106266e6f8
                                                                                                                                                                • Opcode Fuzzy Hash: 326ab8635ccfe50bc88d90765f4c288e68393ea6ffcdc239e8bd96b11199929e
                                                                                                                                                                • Instruction Fuzzy Hash: 7F219075A00A15AFCB14DB58DC45F6EB7BAEF88B20F11412DF516E7390DB75AD008E50
                                                                                                                                                                Function 00629BB0 Relevance: 3.1, APIs: 2, Instructions: 52COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • InitOnceBeginInitialize.KERNEL32(007180C4,00000000,D8276B9A,00000000,D8276B9A,0062A219,007180CC,?,?,?,?,?,?,0062A219,?,?), ref: 00629BE5
                                                                                                                                                                • InitOnceComplete.KERNEL32(007180C4,00000000,00000000), ref: 00629C1D
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: InitOnce$BeginCompleteInitialize
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 51270584-0
                                                                                                                                                                • Opcode ID: af9b25ceab081773d54f816eadfd55a45d29bf350e9ade0b0ddc2d088f521df7
                                                                                                                                                                • Instruction ID: 546e3780e2e878a68ba165ca9b20a4728764c140781dd7f01e21d83a95b6eb83
                                                                                                                                                                • Opcode Fuzzy Hash: af9b25ceab081773d54f816eadfd55a45d29bf350e9ade0b0ddc2d088f521df7
                                                                                                                                                                • Instruction Fuzzy Hash: DC018070B40649AFEB50EF949C46BAAB7B9FB08B04F100629F511AB6C0DF785904CA65
                                                                                                                                                                Function 006999E1 Relevance: 3.0, APIs: 2, Instructions: 42memoryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,00644AA5,?,00000000,00000000,?,0069BE00,0070BF08,000000FE,?,00644AA5), ref: 00699A04
                                                                                                                                                                • SysAllocString.OLEAUT32(00000000), ref: 00699A0F
                                                                                                                                                                  • Part of subcall function 0069E960: _free.LIBCMT ref: 0069E973
                                                                                                                                                                • _com_issue_error.COMSUPP ref: 00699A38
                                                                                                                                                                • _com_issue_error.COMSUPP ref: 00699A42
                                                                                                                                                                • GetLastError.KERNEL32(80070057,D8276B9A,?,00000000,?,0069BE00,0070BF08,000000FE,?,00644AA5,?), ref: 00699A47
                                                                                                                                                                • _com_issue_error.COMSUPP ref: 00699A5A
                                                                                                                                                                • GetLastError.KERNEL32(00000000,?,00000000,?,0069BE00,0070BF08,000000FE,?,00644AA5,?), ref: 00699A70
                                                                                                                                                                • _com_issue_error.COMSUPP ref: 00699A83
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _com_issue_error$ErrorLast$AllocByteCharMultiStringWide_free
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 878839965-0
                                                                                                                                                                • Opcode ID: 75ea43888808b87ff058685d0bf35276d7ccc5ae757f86f24b742311d211ba10
                                                                                                                                                                • Instruction ID: 941c729ca7ae86e36a4e3cb943be946d5ce670aba639585bd298dd73a07e9727
                                                                                                                                                                • Opcode Fuzzy Hash: 75ea43888808b87ff058685d0bf35276d7ccc5ae757f86f24b742311d211ba10
                                                                                                                                                                • Instruction Fuzzy Hash: 6F01A271F052149FDF209F989842BDEB7B9EF48720F00012EE90567740CB315801C7A4
                                                                                                                                                                Function 0064DEC0 Relevance: 3.0, APIs: 2, Instructions: 22registryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SHDeleteKeyW.SHLWAPI(?,006FBFD0,?,0064DE7B), ref: 0064DED6
                                                                                                                                                                • RegCloseKey.KERNEL32(?,?,0064DE7B), ref: 0064DEE4
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseDelete
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 453069226-0
                                                                                                                                                                • Opcode ID: 72d23ae90d3805677aa1342a4f4dbe8ffb4ab0fb43b6f54d665b318438607020
                                                                                                                                                                • Instruction ID: eedf2c79d9b4c966c5fe32cca5823a208ab22f79cfbf7d8c85093ec6ce58dc6d
                                                                                                                                                                • Opcode Fuzzy Hash: 72d23ae90d3805677aa1342a4f4dbe8ffb4ab0fb43b6f54d665b318438607020
                                                                                                                                                                • Instruction Fuzzy Hash: 98E01A70905B519FD7309F29F808B83BBE9AB09710F04C84EE49AC7A90C3B8E880CB54
                                                                                                                                                                Function 0062DEB0 Relevance: 1.8, APIs: 1, Instructions: 298COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SHGetSpecialFolderPathW.SHELL32(00000000,?,00000023,00000001,D8276B9A,?,?), ref: 0062DF08
                                                                                                                                                                • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA),00000001,00000000,00000000), ref: 0062E36C
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: DescriptorSecurity$ConvertFolderPathSpecialString
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 4077199523-0
                                                                                                                                                                • Opcode ID: 1793739cb7ff083b8bc43e4c1d9c34aa67164f8049432c19e7c3d40c4ca14c70
                                                                                                                                                                • Instruction ID: d0d09f96ac6596060e172be2ba25d4a9641c4f04842c3040e4cd724c6ffeac7d
                                                                                                                                                                • Opcode Fuzzy Hash: 1793739cb7ff083b8bc43e4c1d9c34aa67164f8049432c19e7c3d40c4ca14c70
                                                                                                                                                                • Instruction Fuzzy Hash: 8FC124319006248BCB24CF68EC497DDB7B6FF85304F1086ADD40A57691DB76AB84CF94
                                                                                                                                                                Function 006B627A Relevance: 1.6, APIs: 1, Instructions: 147COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: 4559b7de8090c7cd24168b697e22e8430649fd25f54dfa841814fe5cfa92a295
                                                                                                                                                                • Instruction ID: 9403185d8c582853e0ae32c8ce7a8395e32b9ed069515dc73a54ed0249cab2b0
                                                                                                                                                                • Opcode Fuzzy Hash: 4559b7de8090c7cd24168b697e22e8430649fd25f54dfa841814fe5cfa92a295
                                                                                                                                                                • Instruction Fuzzy Hash: 3841D0B1A00104AFDB10DF58C891AEE7BF3EB89364F28916CF4489B391C7399D82CB50
                                                                                                                                                                Function 006B732A Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: __wsopen_s
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3347428461-0
                                                                                                                                                                • Opcode ID: 572f872b5298633bf89bca880bae4dd1e6190bbde37a423a31f730e652aba3e1
                                                                                                                                                                • Instruction ID: 0ed049ff5e0eaa693e01598d4a0d8deda5fae32b831f28e90901728f51d7bd46
                                                                                                                                                                • Opcode Fuzzy Hash: 572f872b5298633bf89bca880bae4dd1e6190bbde37a423a31f730e652aba3e1
                                                                                                                                                                • Instruction Fuzzy Hash: 8A1103B1A0420AAFCF09DF58E9419DE7BF5EF88304B054069F809EB351D630EA11DBA5
                                                                                                                                                                Function 006A5854 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: 738b2551a80a8a8d4bf8db57af4b31d13eda5225752eac16fda81814e4d2ac91
                                                                                                                                                                • Instruction ID: 7aaca241b43372035fd6a515fd800b3386d792093d4eea9f2d3e57df7b4b8fb2
                                                                                                                                                                • Opcode Fuzzy Hash: 738b2551a80a8a8d4bf8db57af4b31d13eda5225752eac16fda81814e4d2ac91
                                                                                                                                                                • Instruction Fuzzy Hash: 6DF04432502A201ADA217629CC017DB329F9F43331F110728F822966D2CB7CDC428B99
                                                                                                                                                                Function 0064DF10 Relevance: 1.5, APIs: 1, Instructions: 41registryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RegCreateKeyExW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?), ref: 0064DF45
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Create
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2289755597-0
                                                                                                                                                                • Opcode ID: f1f4e7866e10ca4185bd306b47168969879943190b12e62d501c77bdaf44ce96
                                                                                                                                                                • Instruction ID: 58ffcb60f98ef9bcb2ecbaf009d9cc14a10392e22ed0ed8761f2ad53f3da98f0
                                                                                                                                                                • Opcode Fuzzy Hash: f1f4e7866e10ca4185bd306b47168969879943190b12e62d501c77bdaf44ce96
                                                                                                                                                                • Instruction Fuzzy Hash: F2012C75900209EBCB25CF45D804F9EBBBAFF99310F10805AF94597350D771AA64DB94
                                                                                                                                                                Function 00666050 Relevance: 1.5, APIs: 1, Instructions: 36COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • PathFileExistsW.SHLWAPI(?), ref: 00666061
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExistsFilePath
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1174141254-0
                                                                                                                                                                • Opcode ID: 4ccd1787689adf352e6e6ed769b57f5315d9db214e240485564055d95f406f51
                                                                                                                                                                • Instruction ID: b635b042d3a1bdb61d3223055214c40129d8b2e7c2b1b4f2d5481a8173344d1a
                                                                                                                                                                • Opcode Fuzzy Hash: 4ccd1787689adf352e6e6ed769b57f5315d9db214e240485564055d95f406f51
                                                                                                                                                                • Instruction Fuzzy Hash: 1DF04931200210CBC7249F69E958B5BB7EAAF88714F00866DE849CB620D779F941CBA4
                                                                                                                                                                Function 006B55F5 Relevance: 1.5, APIs: 1, Instructions: 36COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 006B2174: RtlAllocateHeap.NTDLL(00000000,?,?,?,0069872D,?,?,0062A1ED,0000002C,D8276B9A), ref: 006B21A6
                                                                                                                                                                • _free.LIBCMT ref: 006B5615
                                                                                                                                                                  • Part of subcall function 006B2098: RtlFreeHeap.NTDLL(00000000,00000000,?,006BB729,?,00000000,?,?,?,006BB9CC,?,00000007,?,?,006BBDD6,?), ref: 006B20AE
                                                                                                                                                                  • Part of subcall function 006B2098: GetLastError.KERNEL32(?,?,006BB729,?,00000000,?,?,?,006BB9CC,?,00000007,?,?,006BBDD6,?,?), ref: 006B20C0
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Heap$AllocateErrorFreeLast_free
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 314386986-0
                                                                                                                                                                • Opcode ID: 554049566e076de39a2ab0450aece82a45a26230dcde8b8c844a33a749fdbc2f
                                                                                                                                                                • Instruction ID: 200b4ffea9006b6a88b2dfad95593f63c220cc8a4080b302068ebae85f3fe024
                                                                                                                                                                • Opcode Fuzzy Hash: 554049566e076de39a2ab0450aece82a45a26230dcde8b8c844a33a749fdbc2f
                                                                                                                                                                • Instruction Fuzzy Hash: DBF062B21057009FD3359F59D401BD2F7F8EF84711F10842FE29B976A1DAB4A485CB58
                                                                                                                                                                Function 006B2174 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RtlAllocateHeap.NTDLL(00000000,?,?,?,0069872D,?,?,0062A1ED,0000002C,D8276B9A), ref: 006B21A6
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AllocateHeap
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1279760036-0
                                                                                                                                                                • Opcode ID: 8bcefe5e7fe09545a0eafcb91c05830aa3c205bfebc77fdebe029b562e7fb943
                                                                                                                                                                • Instruction ID: e54641bb255b0ea04ee0846c4d64c58e877712289d12c53f2b23a7781b7a3735
                                                                                                                                                                • Opcode Fuzzy Hash: 8bcefe5e7fe09545a0eafcb91c05830aa3c205bfebc77fdebe029b562e7fb943
                                                                                                                                                                • Instruction Fuzzy Hash: 2BE0E5B120022766E730366D5C247DA36DB9F413A0F105121AF049A391CB20CCC243A5
                                                                                                                                                                Function 0064E500 Relevance: 1.5, APIs: 1, Instructions: 30registryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RegOpenKeyExW.KERNEL32(?,?,00000000,?,?), ref: 0064E51F
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Open
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 71445658-0
                                                                                                                                                                • Opcode ID: 11ef4c4dd6b7c07dce5b955cfc364966fce141ae3913cc893ec62ec841974353
                                                                                                                                                                • Instruction ID: e9e7754e99457c37cf234eed460f4528130e4585e8c84bc291e833e34f08f676
                                                                                                                                                                • Opcode Fuzzy Hash: 11ef4c4dd6b7c07dce5b955cfc364966fce141ae3913cc893ec62ec841974353
                                                                                                                                                                • Instruction Fuzzy Hash: AFF05E31601208ABDB248F09DC04F9EBBA9EF94710F10845EF80597250D6B1AA10CB94
                                                                                                                                                                Function 0062136C Relevance: 1.5, APIs: 1, Instructions: 27COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 006213A5
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Ios_base_dtorstd::ios_base::_
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 323602529-0
                                                                                                                                                                • Opcode ID: 93ececee0dbe4eaf92c3d1ee6b3aabf09da36a32b356a51a5611be5f98bf6722
                                                                                                                                                                • Instruction ID: 40604adeecccdb8417e5bfcad1be824e2322ddd5caade1db1a673cc4a08a5c95
                                                                                                                                                                • Opcode Fuzzy Hash: 93ececee0dbe4eaf92c3d1ee6b3aabf09da36a32b356a51a5611be5f98bf6722
                                                                                                                                                                • Instruction Fuzzy Hash: A5F06572904695EFD715DF44DC01F9AB7EDEB08724F10462EE41193780DFB969048A94
                                                                                                                                                                Function 0064ED10 Relevance: 1.5, APIs: 1, Instructions: 20registryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RegSetValueExW.KERNEL32(?,?,00000000,?,?,?), ref: 0064ED2F
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Value
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3702945584-0
                                                                                                                                                                • Opcode ID: 2a5e8115d7a91556085eb84659dbacbeaa7b54122a55af18559b1e40e0b80610
                                                                                                                                                                • Instruction ID: de0dfba7ab6ecbda5d0d6f5506ba89d8ca2a941203d005e352e8fdf1d79dec5e
                                                                                                                                                                • Opcode Fuzzy Hash: 2a5e8115d7a91556085eb84659dbacbeaa7b54122a55af18559b1e40e0b80610
                                                                                                                                                                • Instruction Fuzzy Hash: 33E0123564010CEBDB008E84EC40FA77B2BFB94700F10C415F9084A595C373DC31ABA0
                                                                                                                                                                Function 006C4D80 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetFileAttributesW.KERNEL32(00000000,?,006C4E6A,00000000,00000000,-00000002,D8276B9A,00000028,00000000,?,00000000,extra,00000005,00000000,00000000,006E44E4), ref: 006C4D92
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AttributesFile
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3188754299-0
                                                                                                                                                                • Opcode ID: c82b2fa2bbfe10e2114611a0f81edac889e548af07e3b0c2840b911c4532dd73
                                                                                                                                                                • Instruction ID: 914f0cebb779cbde36956e9b687532439853a3319a2ca9fcb27252f00565d44b
                                                                                                                                                                • Opcode Fuzzy Hash: c82b2fa2bbfe10e2114611a0f81edac889e548af07e3b0c2840b911c4532dd73
                                                                                                                                                                • Instruction Fuzzy Hash: 2BD05E3112020819AF54AA689479BF6334ADD41B747480659F41FCA2D4EE21F8929110
                                                                                                                                                                Function 006BFE25 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CreateFileW.KERNEL32(00000000,00000000,?,006C0187,?,?,00000000,?,006C0187,00000000,0000000C), ref: 006BFE42
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateFile
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 823142352-0
                                                                                                                                                                • Opcode ID: 316bf5e21d64c94c872966ddccfbf1196fd8d5d84ff6a0ad382f1e547dc79f24
                                                                                                                                                                • Instruction ID: 3dc8b32f5b1237b7f3e1e5ee1677f97dccc8ca0bc738f364cb1359c82063cb6c
                                                                                                                                                                • Opcode Fuzzy Hash: 316bf5e21d64c94c872966ddccfbf1196fd8d5d84ff6a0ad382f1e547dc79f24
                                                                                                                                                                • Instruction Fuzzy Hash: AFD06C3200010DBBDF029F84DD06EDA3BAAFB48714F014000BA1856060C772E931EB91
                                                                                                                                                                Function 0068269D Relevance: 1.5, APIs: 1, Instructions: 13COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00682743: DloadGetSRWLockFunctionPointers.DELAYIMP ref: 00682743
                                                                                                                                                                  • Part of subcall function 00682743: AcquireSRWLockExclusive.KERNEL32(?,006828F1), ref: 00682760
                                                                                                                                                                • DloadProtectSection.DELAYIMP ref: 006826C5
                                                                                                                                                                  • Part of subcall function 0068286C: DloadObtainSection.DELAYIMP ref: 0068287C
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Dload$LockSection$AcquireExclusiveFunctionObtainPointersProtect
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1209458687-0
                                                                                                                                                                • Opcode ID: 5fbf1d11d84ea81d94aef7308230763b0e21dc53c6743acf26328a45696e89a9
                                                                                                                                                                • Instruction ID: 71064af9757c918d20e7097a889c8f8eb89997bef2b7b6404a89daccf80e6c10
                                                                                                                                                                • Opcode Fuzzy Hash: 5fbf1d11d84ea81d94aef7308230763b0e21dc53c6743acf26328a45696e89a9
                                                                                                                                                                • Instruction Fuzzy Hash: C0D012705143424BCB91BB1BACEA7D4229AB314700F50C645F505C51F4D7B948C2CB6D
                                                                                                                                                                Function 0064E8C0 Relevance: 1.5, APIs: 1, Instructions: 11registryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RegQueryValueExW.KERNEL32(?,?,00000000,?,?,?), ref: 0064E8D4
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: QueryValue
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3660427363-0
                                                                                                                                                                • Opcode ID: f53a91e11d33e4519d50b6cc3bb200a27def5a33355d9cdba7367febd105a375
                                                                                                                                                                • Instruction ID: 6a82cf8382eb7ab776c70b2d618c2eb88c04a8f8c45d9fe510ef0a7e3054c414
                                                                                                                                                                • Opcode Fuzzy Hash: f53a91e11d33e4519d50b6cc3bb200a27def5a33355d9cdba7367febd105a375
                                                                                                                                                                • Instruction Fuzzy Hash: F1D0EA3604020DBBDF025F81ED05E9A7F2AEB19761F148416FA191806187B39571EBA5
                                                                                                                                                                Function 0069E960 Relevance: 1.5, APIs: 1, Instructions: 11COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • _free.LIBCMT ref: 0069E973
                                                                                                                                                                  • Part of subcall function 006B2098: RtlFreeHeap.NTDLL(00000000,00000000,?,006BB729,?,00000000,?,?,?,006BB9CC,?,00000007,?,?,006BBDD6,?), ref: 006B20AE
                                                                                                                                                                  • Part of subcall function 006B2098: GetLastError.KERNEL32(?,?,006BB729,?,00000000,?,?,?,006BB9CC,?,00000007,?,?,006BBDD6,?,?), ref: 006B20C0
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorFreeHeapLast_free
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1353095263-0
                                                                                                                                                                • Opcode ID: fab4fa4e78e3bb56b6f0db2a41ca46f282b47d196b259d4a4af83b9d8bde8242
                                                                                                                                                                • Instruction ID: c7632fc3e81905f8003967f881094ac82f5d01a1ef5de048bd171f2e5c96fcc4
                                                                                                                                                                • Opcode Fuzzy Hash: fab4fa4e78e3bb56b6f0db2a41ca46f282b47d196b259d4a4af83b9d8bde8242
                                                                                                                                                                • Instruction Fuzzy Hash: E7C08C7100020CBBCB00AB45C806A8E7BA9DB80364F200048F40117241CAB1EE449780
                                                                                                                                                                Function 00674DB8 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ___delayLoadHelper2@8.DELAYIMP ref: 00674DAF
                                                                                                                                                                  • Part of subcall function 0068293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006829AF
                                                                                                                                                                  • Part of subcall function 0068293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006829C0
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1269201914-0
                                                                                                                                                                • Opcode ID: 5647ece3aed1506e48db34738f34a266ef7334ee9c57b408371e0a850e372bc9
                                                                                                                                                                • Instruction ID: cb35d6d8261099c70269afd3ca716ccc74f8854df5987c34c493fe977d62c717
                                                                                                                                                                • Opcode Fuzzy Hash: 5647ece3aed1506e48db34738f34a266ef7334ee9c57b408371e0a850e372bc9
                                                                                                                                                                • Instruction Fuzzy Hash: 63B012E1798102FCB694A2596C1AC37015ECBC8B10330C23EF84CC01D0DD444C460131
                                                                                                                                                                Function 00674D9D Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ___delayLoadHelper2@8.DELAYIMP ref: 00674DAF
                                                                                                                                                                  • Part of subcall function 0068293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006829AF
                                                                                                                                                                  • Part of subcall function 0068293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006829C0
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1269201914-0
                                                                                                                                                                • Opcode ID: 574adf6cc8ad65af74fd6e18895821f06c9d20e31e1bc5c2b337dc84868e50b3
                                                                                                                                                                • Instruction ID: 514553f83518c9b29c862d76c961799fa0a580f3e7fef212768af2cc6da9a033
                                                                                                                                                                • Opcode Fuzzy Hash: 574adf6cc8ad65af74fd6e18895821f06c9d20e31e1bc5c2b337dc84868e50b3
                                                                                                                                                                • Instruction Fuzzy Hash: 6BB012E1399106BC7254A245AC1AC37012EDFC5F107B0822EF484C00D0DD444C424071
                                                                                                                                                                Function 006814C6 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ___delayLoadHelper2@8.DELAYIMP ref: 006814D8
                                                                                                                                                                  • Part of subcall function 0068293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006829AF
                                                                                                                                                                  • Part of subcall function 0068293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006829C0
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1269201914-0
                                                                                                                                                                • Opcode ID: 8143165effa2a2033fc6a7b1691fa34a3d9d0f5aef8af1e04a9c85e58c12d8ba
                                                                                                                                                                • Instruction ID: 732690fd5439e23fd11c378123a1e3af44a62f895786bebc0ff3f4d469b7a2d0
                                                                                                                                                                • Opcode Fuzzy Hash: 8143165effa2a2033fc6a7b1691fa34a3d9d0f5aef8af1e04a9c85e58c12d8ba
                                                                                                                                                                • Instruction Fuzzy Hash: 8DB012F1258102BC370432565D16C37118EC1C1F20731C32EF500C60C1D8481C431135
                                                                                                                                                                Function 006997AC Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ___delayLoadHelper2@8.DELAYIMP ref: 006997C4
                                                                                                                                                                  • Part of subcall function 0068293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006829AF
                                                                                                                                                                  • Part of subcall function 0068293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006829C0
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1269201914-0
                                                                                                                                                                • Opcode ID: 4f00ff4406f2d5cac49e794dcf59562ccad7a8c8f7a767818dada7402e9387d6
                                                                                                                                                                • Instruction ID: d73cd3a3c0210011b7f508d89996cca0dc23b44baea6be922c960495cd584bdf
                                                                                                                                                                • Opcode Fuzzy Hash: 4f00ff4406f2d5cac49e794dcf59562ccad7a8c8f7a767818dada7402e9387d6
                                                                                                                                                                • Instruction Fuzzy Hash: 9FB012F1278102BC3B04329D5D26C37111EC1C4F10331C63EFD04D40C1AC450C474031
                                                                                                                                                                Function 00699BFA Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ___delayLoadHelper2@8.DELAYIMP ref: 00699BE7
                                                                                                                                                                  • Part of subcall function 0068293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006829AF
                                                                                                                                                                  • Part of subcall function 0068293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006829C0
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1269201914-0
                                                                                                                                                                • Opcode ID: 1f2e17643730f5666db410584c1bab233d87234df360fe52b78ba7e81eca356c
                                                                                                                                                                • Instruction ID: aa0f9764eb3a799d3fc5b7d7086e6eaf74088a8b601cb0527eb68910797c4a10
                                                                                                                                                                • Opcode Fuzzy Hash: 1f2e17643730f5666db410584c1bab233d87234df360fe52b78ba7e81eca356c
                                                                                                                                                                • Instruction Fuzzy Hash: EFB012F126C206FC3A84624D6C16C77025EC1C4B10330872FFA04C02C0D8480CC21131
                                                                                                                                                                Function 00699BF0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ___delayLoadHelper2@8.DELAYIMP ref: 00699BE7
                                                                                                                                                                  • Part of subcall function 0068293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006829AF
                                                                                                                                                                  • Part of subcall function 0068293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006829C0
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1269201914-0
                                                                                                                                                                • Opcode ID: 0a44791e9466e3a71fd53985121f2dc3a4c0ab1eeb6cc86658ddbc9135448492
                                                                                                                                                                • Instruction ID: 1ebbcc1fd505befc4e4bbd274f17059c8f63b309229a3b19b43d4ec3422b795f
                                                                                                                                                                • Opcode Fuzzy Hash: 0a44791e9466e3a71fd53985121f2dc3a4c0ab1eeb6cc86658ddbc9135448492
                                                                                                                                                                • Instruction Fuzzy Hash: A0B012F126C106BC3784624D6D16C77114EC1C4F10331872FF704C02C0E8480CC31135
                                                                                                                                                                Function 00699C4A Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ___delayLoadHelper2@8.DELAYIMP ref: 00699BE7
                                                                                                                                                                  • Part of subcall function 0068293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006829AF
                                                                                                                                                                  • Part of subcall function 0068293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006829C0
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1269201914-0
                                                                                                                                                                • Opcode ID: 3c97a373e361847a2bf57471d800ac352270c55ea08ae0713ae8b3d65e65d6a4
                                                                                                                                                                • Instruction ID: 822dfe914f3670b6f2d1b4515560b0421a4ed99239dd2d0604587a18707ba486
                                                                                                                                                                • Opcode Fuzzy Hash: 3c97a373e361847a2bf57471d800ac352270c55ea08ae0713ae8b3d65e65d6a4
                                                                                                                                                                • Instruction Fuzzy Hash: 99B012E126C106FC3754624DAD16D77114EC1C4F10331873FF704C02D0E8484C832131
                                                                                                                                                                Function 00699C40 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ___delayLoadHelper2@8.DELAYIMP ref: 00699BE7
                                                                                                                                                                  • Part of subcall function 0068293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006829AF
                                                                                                                                                                  • Part of subcall function 0068293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006829C0
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1269201914-0
                                                                                                                                                                • Opcode ID: bfc052b6b65024d17bbbb6ac481daa0338fa5d9ab669e52eb2af063367fc28b4
                                                                                                                                                                • Instruction ID: 2863273c84259bbf492c941d7c2287105b0c9428863cd5bbfc6d1786ebbb710b
                                                                                                                                                                • Opcode Fuzzy Hash: bfc052b6b65024d17bbbb6ac481daa0338fa5d9ab669e52eb2af063367fc28b4
                                                                                                                                                                • Instruction Fuzzy Hash: CCB012E126C206FC3754624D6C16DB7014EC1C4B10330473FFA04C02C0E8484DC62172
                                                                                                                                                                Function 00699C54 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ___delayLoadHelper2@8.DELAYIMP ref: 00699BE7
                                                                                                                                                                  • Part of subcall function 0068293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006829AF
                                                                                                                                                                  • Part of subcall function 0068293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006829C0
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1269201914-0
                                                                                                                                                                • Opcode ID: 4c5e8b295b29ad59a4bad47a19aabdf121f8bf9c30b66d62f4448f00454a9bc9
                                                                                                                                                                • Instruction ID: 9877875683d34f203cc56d52e32a58bc677a40951a1af96759425ee002cfebe7
                                                                                                                                                                • Opcode Fuzzy Hash: 4c5e8b295b29ad59a4bad47a19aabdf121f8bf9c30b66d62f4448f00454a9bc9
                                                                                                                                                                • Instruction Fuzzy Hash: EEB012E136C106FC3654A24D6C16E77015ED1C4B103304B3FF604C02C0E8484C826131
                                                                                                                                                                Function 00699C2C Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ___delayLoadHelper2@8.DELAYIMP ref: 00699BE7
                                                                                                                                                                  • Part of subcall function 0068293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006829AF
                                                                                                                                                                  • Part of subcall function 0068293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006829C0
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1269201914-0
                                                                                                                                                                • Opcode ID: 8e2a8429113fceeb6655d52beb33b620bd3a2354ebc23257bbdde1f1da604f6b
                                                                                                                                                                • Instruction ID: 639cc9a7ef52b3b93dfe6775fb3f8a654aff247b9c9a49f1d160335e5edaeb67
                                                                                                                                                                • Opcode Fuzzy Hash: 8e2a8429113fceeb6655d52beb33b620bd3a2354ebc23257bbdde1f1da604f6b
                                                                                                                                                                • Instruction Fuzzy Hash: A6B012E226C20ABC3644A24D6C16DB7019FD1C4B10330472FF604C02C0D8480C825131
                                                                                                                                                                Function 00699C22 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ___delayLoadHelper2@8.DELAYIMP ref: 00699BE7
                                                                                                                                                                  • Part of subcall function 0068293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006829AF
                                                                                                                                                                  • Part of subcall function 0068293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006829C0
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1269201914-0
                                                                                                                                                                • Opcode ID: df16f5b3f14893eba8f728cdcfd9ef1b180b500f471091a92b598baf20b04db8
                                                                                                                                                                • Instruction ID: 68cc811b1ab9db5f77d598046277043783b3c5aa33edd839774bf524805bc9ad
                                                                                                                                                                • Opcode Fuzzy Hash: df16f5b3f14893eba8f728cdcfd9ef1b180b500f471091a92b598baf20b04db8
                                                                                                                                                                • Instruction Fuzzy Hash: 6EB012F126C106BC3744624D6D16CB711DEC1C4F10731872FF704C02C0D8480C831131
                                                                                                                                                                Function 00699C36 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ___delayLoadHelper2@8.DELAYIMP ref: 00699BE7
                                                                                                                                                                  • Part of subcall function 0068293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006829AF
                                                                                                                                                                  • Part of subcall function 0068293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006829C0
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1269201914-0
                                                                                                                                                                • Opcode ID: 2c9b4875af2ecd68bbc7acb43df9cefa8327101377d33ca70cf11bd895715377
                                                                                                                                                                • Instruction ID: 05c5f1df79dc0e51d510d9dd1f11acac8c401c7b60c251f127d74b16e09415f3
                                                                                                                                                                • Opcode Fuzzy Hash: 2c9b4875af2ecd68bbc7acb43df9cefa8327101377d33ca70cf11bd895715377
                                                                                                                                                                • Instruction Fuzzy Hash: 22B012E126C106FC3A54624D6C16D77014EC1C4B10330873FFA04C02C0E8488C822131
                                                                                                                                                                Function 00699C0E Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ___delayLoadHelper2@8.DELAYIMP ref: 00699BE7
                                                                                                                                                                  • Part of subcall function 0068293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006829AF
                                                                                                                                                                  • Part of subcall function 0068293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006829C0
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1269201914-0
                                                                                                                                                                • Opcode ID: 209e91124686a82a41678b4329615dbfb6efb0f51955005cf8730a30cd57fdec
                                                                                                                                                                • Instruction ID: 984d336f9b1149c7a6255398e4652bf0ab2c45df51ac42529dd99b55e7a4422e
                                                                                                                                                                • Opcode Fuzzy Hash: 209e91124686a82a41678b4329615dbfb6efb0f51955005cf8730a30cd57fdec
                                                                                                                                                                • Instruction Fuzzy Hash: 40B012E126C106FC3A44629D6C16CB7018EC1C4B10330872FFA04C02C0D8480C821131
                                                                                                                                                                Function 00699C04 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ___delayLoadHelper2@8.DELAYIMP ref: 00699BE7
                                                                                                                                                                  • Part of subcall function 0068293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006829AF
                                                                                                                                                                  • Part of subcall function 0068293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006829C0
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1269201914-0
                                                                                                                                                                • Opcode ID: 4335d30cfd92d8d34108bda0181a87468c44c7f2109f716f19005c7504fed722
                                                                                                                                                                • Instruction ID: 689e07783593958850b63575717e5a53697f644c25bb56822fb597167c21f5c2
                                                                                                                                                                • Opcode Fuzzy Hash: 4335d30cfd92d8d34108bda0181a87468c44c7f2109f716f19005c7504fed722
                                                                                                                                                                • Instruction Fuzzy Hash: 44B012F126C106BC3684A24D6C16D77015ED2C4B10330472FF604C02C0D8480CC29131
                                                                                                                                                                Function 00699C18 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ___delayLoadHelper2@8.DELAYIMP ref: 00699BE7
                                                                                                                                                                  • Part of subcall function 0068293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006829AF
                                                                                                                                                                  • Part of subcall function 0068293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006829C0
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1269201914-0
                                                                                                                                                                • Opcode ID: 1e878aae56d2a372cd72e33983cb9759de735602a431de7fa487b86f4de4a640
                                                                                                                                                                • Instruction ID: c3b7550429abb7e6e4f9c81f220c0279fc9235c47af66fd862ab0c7a9012c135
                                                                                                                                                                • Opcode Fuzzy Hash: 1e878aae56d2a372cd72e33983cb9759de735602a431de7fa487b86f4de4a640
                                                                                                                                                                • Instruction Fuzzy Hash: 23B012E526C206BC3744624D6C16CF7018EC1C4B10330472FFA04C02C0D8480CC61132
                                                                                                                                                                Function 0064ECD0 Relevance: 1.3, APIs: 1, Instructions: 30stringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: lstrlen
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1659193697-0
                                                                                                                                                                • Opcode ID: b7d8a1d7ded2d5281f212ed891ad0cde123863cd9d52bf12014fe205cb4d08fb
                                                                                                                                                                • Instruction ID: a5dd70fa963b08e43a2baf5d5cfe953a4f6ed8107304a87844701f4fef244954
                                                                                                                                                                • Opcode Fuzzy Hash: b7d8a1d7ded2d5281f212ed891ad0cde123863cd9d52bf12014fe205cb4d08fb
                                                                                                                                                                • Instruction Fuzzy Hash: 53E0ED3B200519ABDB019B89EC84D9AFB6DFBD5371704403BFA1487620D772AC25CBA0

                                                                                                                                                                Non-executed Functions

                                                                                                                                                                Function 00650540 Relevance: 98.2, APIs: 29, Strings: 27, Instructions: 220libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • EnterCriticalSection.KERNEL32(?,D8276B9A), ref: 00650571
                                                                                                                                                                • FreeLibrary.KERNEL32(00000000), ref: 006505B7
                                                                                                                                                                • GetProcAddress.KERNEL32(?,SetEntriesInAclW), ref: 006505DD
                                                                                                                                                                • GetProcAddress.KERNEL32(?,GetFileSecurityW), ref: 006505E9
                                                                                                                                                                • GetProcAddress.KERNEL32(?,SetFileSecurityW), ref: 006505F5
                                                                                                                                                                • GetProcAddress.KERNEL32(?,LookupAccountSidW), ref: 00650601
                                                                                                                                                                • GetProcAddress.KERNEL32(?,GetExplicitEntriesFromAclW), ref: 0065060D
                                                                                                                                                                • GetProcAddress.KERNEL32(?,RegGetKeySecurity), ref: 0065061C
                                                                                                                                                                • GetProcAddress.KERNEL32(?,RegSetKeySecurity), ref: 00650628
                                                                                                                                                                • GetProcAddress.KERNEL32(?,InitializeSecurityDescriptor), ref: 00650634
                                                                                                                                                                • GetProcAddress.KERNEL32(?,SetSecurityDescriptorDacl), ref: 00650640
                                                                                                                                                                • GetProcAddress.KERNEL32(?,GetSecurityDescriptorDacl), ref: 0065064C
                                                                                                                                                                • GetProcAddress.KERNEL32(?,AllocateAndInitializeSid), ref: 00650658
                                                                                                                                                                • GetProcAddress.KERNEL32(?,FreeSid), ref: 00650664
                                                                                                                                                                • GetProcAddress.KERNEL32(?,OpenThreadToken), ref: 00650670
                                                                                                                                                                • GetProcAddress.KERNEL32(?,GetTokenInformation), ref: 0065067C
                                                                                                                                                                • GetProcAddress.KERNEL32(?,InitializeAcl), ref: 00650688
                                                                                                                                                                • GetProcAddress.KERNEL32(?,InitializeSid), ref: 00650694
                                                                                                                                                                • GetProcAddress.KERNEL32(?,GetSidSubAuthority), ref: 006506A0
                                                                                                                                                                • GetProcAddress.KERNEL32(?,AddAccessAllowedAce), ref: 006506AC
                                                                                                                                                                • GetProcAddress.KERNEL32(?,GetSecurityInfo), ref: 006506B8
                                                                                                                                                                • GetProcAddress.KERNEL32(?,SetSecurityInfo), ref: 006506C4
                                                                                                                                                                • GetProcAddress.KERNEL32(?,QueryServiceStatusEx), ref: 006506D0
                                                                                                                                                                • GetProcAddress.KERNEL32(?,GetAce), ref: 006506DC
                                                                                                                                                                • GetProcAddress.KERNEL32(?,DeleteAce), ref: 006506E8
                                                                                                                                                                • GetProcAddress.KERNEL32(?,EqualSid), ref: 006506F4
                                                                                                                                                                • GetProcAddress.KERNEL32(?,GetAclInformation), ref: 00650700
                                                                                                                                                                • GetProcAddress.KERNEL32(?,SetSecurityDescriptorControl), ref: 0065070F
                                                                                                                                                                • LeaveCriticalSection.KERNEL32(?), ref: 006507DE
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressProc$CriticalSection$EnterFreeLeaveLibrary
                                                                                                                                                                • String ID: AddAccessAllowedAce$AllocateAndInitializeSid$DeleteAce$EqualSid$FreeSid$GetAce$GetAclInformation$GetExplicitEntriesFromAclW$GetFileSecurityW$GetSecurityDescriptorDacl$GetSecurityInfo$GetSidSubAuthority$GetTokenInformation$InitializeAcl$InitializeSecurityDescriptor$InitializeSid$LookupAccountSidW$OpenThreadToken$QueryServiceStatusEx$RegGetKeySecurity$RegSetKeySecurity$SetEntriesInAclW$SetFileSecurityW$SetSecurityDescriptorControl$SetSecurityDescriptorDacl$SetSecurityInfo$advapi32.dll
                                                                                                                                                                • API String ID: 2701342527-838666417
                                                                                                                                                                • Opcode ID: 5d479e1fb54dbb815ee3248a8b19c8965dad54b3db3fb889b93d2860369a6acc
                                                                                                                                                                • Instruction ID: d9512aa2ea1d1abc3dbd2f0134a291804c338ac495c4ab3ab93236da7537c176
                                                                                                                                                                • Opcode Fuzzy Hash: 5d479e1fb54dbb815ee3248a8b19c8965dad54b3db3fb889b93d2860369a6acc
                                                                                                                                                                • Instruction Fuzzy Hash: 05814B31941B55FFDF219F62CC48B95BFA2FF09316F00012AE90466AA0D7B5A4A8DFC1
                                                                                                                                                                Function 0066F3C0 Relevance: 33.7, APIs: 13, Strings: 6, Instructions: 463encryptionCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CryptMsgGetParam.CRYPT32(00000000,00000005,00000000,?,?), ref: 0066F442
                                                                                                                                                                • CryptMsgGetParam.CRYPT32(00000000,00000006,00000000,00000000,00000004), ref: 0066F488
                                                                                                                                                                • CryptMsgGetParam.CRYPT32(?,00000006,00000000,00000000,00000000), ref: 0066F4C6
                                                                                                                                                                • CertGetSubjectCertificateFromStore.CRYPT32(?,00010001,?), ref: 0066F527
                                                                                                                                                                • CertGetNameStringW.CRYPT32(00000000,00000005,00000000,00000000,00000000,00000000), ref: 0066F5AD
                                                                                                                                                                • CertGetNameStringW.CRYPT32(?,00000005,00000000,00000000,00000000,?), ref: 0066F602
                                                                                                                                                                • CertGetCertificateChain.CRYPT32(00000000,?,?,00000000,00000010,00000000,00000000,?), ref: 0066F89C
                                                                                                                                                                • CertFreeCertificateChain.CRYPT32(00000000), ref: 0066F8B1
                                                                                                                                                                • CertFreeCertificateChain.CRYPT32(00000000), ref: 0066F8CB
                                                                                                                                                                  • Part of subcall function 0066E760: CertGetCertificateContextProperty.CRYPT32(?,00000003,00000000,00000000), ref: 0066E877
                                                                                                                                                                • CertVerifyCertificateChainPolicy.CRYPT32(00000003,00000000,0000000C,00000014), ref: 0066F906
                                                                                                                                                                • CertFreeCertificateChain.CRYPT32(00000000), ref: 0066F942
                                                                                                                                                                • CertFreeCRLContext.CRYPT32(?), ref: 0066FA73
                                                                                                                                                                • CertFreeCRLContext.CRYPT32(00000000), ref: 0066FAA6
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Cert$Certificate$ChainFree$ContextCryptParam$NameString$FromPolicyPropertyStoreSubjectVerify
                                                                                                                                                                • String ID: 4$Intel Corporation$McAfee, Inc.$McAfee, LLC$McAfee, LLC.$Yahoo! Inc.
                                                                                                                                                                • API String ID: 2452394995-549729705
                                                                                                                                                                • Opcode ID: 18479bd7128053a22d9ef8daa1c1add96ded7f43c836732c9eacf15d5ae37ab3
                                                                                                                                                                • Instruction ID: a1979ccbae3cd00092469fa6aef6e335efbe7a51e61dc666e14a7e3c201358d0
                                                                                                                                                                • Opcode Fuzzy Hash: 18479bd7128053a22d9ef8daa1c1add96ded7f43c836732c9eacf15d5ae37ab3
                                                                                                                                                                • Instruction Fuzzy Hash: 0E129071900229DBDF60DF24DC49BEAB7B6AF19714F0441E9E909A7391E7329E84CF60
                                                                                                                                                                Function 0066EB60 Relevance: 27.5, APIs: 18, Instructions: 477encryptionCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CryptQueryObject.CRYPT32(00000001,0065BDCE,00000400,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0066EBD2
                                                                                                                                                                • CryptMsgClose.CRYPT32(00000000), ref: 0066EBE4
                                                                                                                                                                • CertCloseStore.CRYPT32(00000000,00000001), ref: 0066EBF4
                                                                                                                                                                • CryptMsgClose.CRYPT32(00000000), ref: 0066ECEE
                                                                                                                                                                • CertCloseStore.CRYPT32(00000000,00000001), ref: 0066ECFE
                                                                                                                                                                • CryptQueryObject.CRYPT32(00000002,?,00003FFE,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0066EDEE
                                                                                                                                                                • CryptMsgClose.CRYPT32(00000000), ref: 0066EE0A
                                                                                                                                                                • CertCloseStore.CRYPT32(00000000,00000001), ref: 0066EE1C
                                                                                                                                                                • CryptMsgClose.CRYPT32(00000000), ref: 0066EEB6
                                                                                                                                                                • CertCloseStore.CRYPT32(00000000,00000001), ref: 0066EEC2
                                                                                                                                                                  • Part of subcall function 0066F3C0: CryptMsgGetParam.CRYPT32(00000000,00000005,00000000,?,?), ref: 0066F442
                                                                                                                                                                  • Part of subcall function 0066F3C0: CryptMsgGetParam.CRYPT32(00000000,00000006,00000000,00000000,00000004), ref: 0066F488
                                                                                                                                                                  • Part of subcall function 0066F3C0: CryptMsgGetParam.CRYPT32(?,00000006,00000000,00000000,00000000), ref: 0066F4C6
                                                                                                                                                                  • Part of subcall function 0066F3C0: CertGetSubjectCertificateFromStore.CRYPT32(?,00010001,?), ref: 0066F527
                                                                                                                                                                • CryptMsgClose.CRYPT32(00000000), ref: 0066EF02
                                                                                                                                                                • CertCloseStore.CRYPT32(00000000,00000001), ref: 0066EF14
                                                                                                                                                                • CryptMsgClose.CRYPT32(00000000), ref: 0066EFAE
                                                                                                                                                                • CertCloseStore.CRYPT32(00000000,00000001), ref: 0066EFBA
                                                                                                                                                                • CryptMsgClose.CRYPT32(00000000), ref: 0066EFDA
                                                                                                                                                                • CertCloseStore.CRYPT32(00000000,00000001), ref: 0066EFEA
                                                                                                                                                                • CryptMsgClose.CRYPT32(00000000), ref: 0066F0CB
                                                                                                                                                                • CertCloseStore.CRYPT32(00000000,00000001), ref: 0066F0DB
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Close$Crypt$CertStore$Param$ObjectQuery$CertificateFromSubject
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2648890560-0
                                                                                                                                                                • Opcode ID: dcd3fc399e26e088230868a82a1b45fa013a342f08cca9813b9c47ddd9939e0f
                                                                                                                                                                • Instruction ID: 9b86222fcea4abbaee8a9fceff2340e895176ec156dca3c6f3b230c6936f7233
                                                                                                                                                                • Opcode Fuzzy Hash: dcd3fc399e26e088230868a82a1b45fa013a342f08cca9813b9c47ddd9939e0f
                                                                                                                                                                • Instruction Fuzzy Hash: 64025F71E002099BEF14DFA8CD99BEEBBB9AF48704F144159E501F7381DB799A04CBA4
                                                                                                                                                                Function 00636220 Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 428encryptionthreadCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetCurrentProcessId.KERNEL32(?,?), ref: 00636268
                                                                                                                                                                • GetCurrentThreadId.KERNEL32 ref: 00636274
                                                                                                                                                                • CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000,?,?,?,?,?,?,?,?), ref: 006363BF
                                                                                                                                                                • CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000,?,?,?,?,?,?,?,?), ref: 006363DF
                                                                                                                                                                • CryptHashData.ADVAPI32(00000000,?,00000000,00000000,?,?,?,?,?,?,?,?), ref: 006363FC
                                                                                                                                                                Strings
                                                                                                                                                                • al exception rule %x:%x res %s, xrefs: 0063632E
                                                                                                                                                                • 3c224a00-5d51-11cf-b3ca-000000000001, xrefs: 0063671E
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Crypt$CurrentHash$AcquireContextCreateDataProcessThread
                                                                                                                                                                • String ID: 3c224a00-5d51-11cf-b3ca-000000000001$al exception rule %x:%x res %s
                                                                                                                                                                • API String ID: 3004248768-911235813
                                                                                                                                                                • Opcode ID: 26d563f0f9f01d54584ed2d36d182569a2e6cf1306b3bb4ce85e12fa142d1e1d
                                                                                                                                                                • Instruction ID: e446a156e8509d896f746c86edfb734cdbea68714cb40f9ca06f41f44c2bf335
                                                                                                                                                                • Opcode Fuzzy Hash: 26d563f0f9f01d54584ed2d36d182569a2e6cf1306b3bb4ce85e12fa142d1e1d
                                                                                                                                                                • Instruction Fuzzy Hash: 87F10935B012289FDB259F14CC95BEDB7B6BF48710F154099EA0AAB391CB70AE41CF91
                                                                                                                                                                Function 006367B0 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 150encryptionthreadCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetCurrentProcessId.KERNEL32 ref: 006367F3
                                                                                                                                                                • GetCurrentThreadId.KERNEL32 ref: 006367FB
                                                                                                                                                                • CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 0063687F
                                                                                                                                                                • CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0063689F
                                                                                                                                                                • CryptHashData.ADVAPI32(00000000,?,00000000,00000000), ref: 006368BC
                                                                                                                                                                • CryptGetHashParam.ADVAPI32(00000000,00000002,?,00000010,00000000), ref: 006368DE
                                                                                                                                                                • CryptDestroyHash.ADVAPI32(00000000), ref: 006368EF
                                                                                                                                                                • CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 00636902
                                                                                                                                                                • DeviceIoControl.KERNEL32(00000000,9EDBA51C,00000000,00000000,00000000,00000000,?,00000000), ref: 00636951
                                                                                                                                                                • DeviceIoControl.KERNEL32(?,9EDB651C,00000000,00000000,00000000,00000000,?,00000000), ref: 00636980
                                                                                                                                                                Strings
                                                                                                                                                                • al exception rule %x:%x res %s, xrefs: 00636824
                                                                                                                                                                • Freeing access handle %p, xrefs: 006367D0
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Crypt$Hash$ContextControlCurrentDevice$AcquireCreateDataDestroyParamProcessReleaseThread
                                                                                                                                                                • String ID: Freeing access handle %p$al exception rule %x:%x res %s
                                                                                                                                                                • API String ID: 581428007-3582322424
                                                                                                                                                                • Opcode ID: 0d5ce5048d82d192b6b501ebbef7da8516dd6541e6e5bf2a78ae378769cf6c0a
                                                                                                                                                                • Instruction ID: c86f5f98e16f45bb6622be101cb60a1ecc0767c3cf2c5462b62ffb2d91398f65
                                                                                                                                                                • Opcode Fuzzy Hash: 0d5ce5048d82d192b6b501ebbef7da8516dd6541e6e5bf2a78ae378769cf6c0a
                                                                                                                                                                • Instruction Fuzzy Hash: 66518671A40219ABDF209F60DC45FDA77B9AB18710F144195FA05EA2D0DBB0EE94CFA4
                                                                                                                                                                Function 0066F150 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 342encryptionCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CryptMsgGetParam.CRYPT32(00000000,00000005,00000000,?,?), ref: 0066F442
                                                                                                                                                                • CryptMsgGetParam.CRYPT32(00000000,00000006,00000000,00000000,00000004), ref: 0066F488
                                                                                                                                                                • CryptMsgGetParam.CRYPT32(?,00000006,00000000,00000000,00000000), ref: 0066F4C6
                                                                                                                                                                • CertGetSubjectCertificateFromStore.CRYPT32(?,00010001,?), ref: 0066F527
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CryptParam$CertCertificateFromStoreSubject
                                                                                                                                                                • String ID: 1.3.6.1.4.1.311.2.4.1
                                                                                                                                                                • API String ID: 738114118-146536318
                                                                                                                                                                • Opcode ID: 796c42f4b5ca941d3fa6d67ecbab9cbabfd24343a4ce7f7141eb2375e4f73254
                                                                                                                                                                • Instruction ID: 745546c78f0f4a740c70cb6ba4ec63bebcef830943fab44c1a077016f2cd8140
                                                                                                                                                                • Opcode Fuzzy Hash: 796c42f4b5ca941d3fa6d67ecbab9cbabfd24343a4ce7f7141eb2375e4f73254
                                                                                                                                                                • Instruction Fuzzy Hash: 3FD17D71D00219DFCB24DF68D885BEEBBB6EF49710F1041A9E819A7340DB35AA45CFA0
                                                                                                                                                                Function 006BCFDB Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 006B1CA9: GetLastError.KERNEL32(00000008,00000016,00000000,006B4E01), ref: 006B1CAE
                                                                                                                                                                  • Part of subcall function 006B1CA9: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 006B1D4C
                                                                                                                                                                  • Part of subcall function 006B1CA9: _free.LIBCMT ref: 006B1D0B
                                                                                                                                                                  • Part of subcall function 006B1CA9: _free.LIBCMT ref: 006B1D41
                                                                                                                                                                • GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 006BD0E7
                                                                                                                                                                • IsValidCodePage.KERNEL32(00000000), ref: 006BD130
                                                                                                                                                                • IsValidLocale.KERNEL32(?,00000001), ref: 006BD13F
                                                                                                                                                                • GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 006BD187
                                                                                                                                                                • GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 006BD1A6
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Locale$ErrorInfoLastValid_free$CodeDefaultPageUser
                                                                                                                                                                • String ID: (3o
                                                                                                                                                                • API String ID: 949163717-3766081459
                                                                                                                                                                • Opcode ID: 79e6780ed12f9a6fa3ee9cfe6a7521b522a4d34fdeeff6fc9ce97771471a6e05
                                                                                                                                                                • Instruction ID: 0ac7c5dabc93978a30a9359470a3982bdd57c873d742a311f391001d13b0bb51
                                                                                                                                                                • Opcode Fuzzy Hash: 79e6780ed12f9a6fa3ee9cfe6a7521b522a4d34fdeeff6fc9ce97771471a6e05
                                                                                                                                                                • Instruction Fuzzy Hash: 395173B2A00216AFDB10EFA4CC41AFA77BAFF05700F144429E515EF290EB71DA85CB65
                                                                                                                                                                Function 006BCE06 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetLocaleInfoW.KERNEL32(?,2000000B,006BD124,00000002,00000000,?,?,?,006BD124,?,00000000), ref: 006BCE9F
                                                                                                                                                                • GetLocaleInfoW.KERNEL32(?,20001004,006BD124,00000002,00000000,?,?,?,006BD124,?,00000000), ref: 006BCEC8
                                                                                                                                                                • GetACP.KERNEL32(?,?,006BD124,?,00000000), ref: 006BCEDD
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: InfoLocale
                                                                                                                                                                • String ID: ACP$OCP
                                                                                                                                                                • API String ID: 2299586839-711371036
                                                                                                                                                                • Opcode ID: c6f0cfabdede73f1bcf613d544af87f7e8e594c530e05abaa3567b3fb86974c9
                                                                                                                                                                • Instruction ID: abab8cb6cd6407cb4557684f026488e490544d15aae26503911fcda0a99d7547
                                                                                                                                                                • Opcode Fuzzy Hash: c6f0cfabdede73f1bcf613d544af87f7e8e594c530e05abaa3567b3fb86974c9
                                                                                                                                                                • Instruction Fuzzy Hash: 632183B2B40105EAEB349F24C940AE773A7AB54B74B568464E906DB304E732DFC3C390
                                                                                                                                                                Function 006993F2 Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 006993FE
                                                                                                                                                                • IsDebuggerPresent.KERNEL32 ref: 006994CA
                                                                                                                                                                • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 006994EA
                                                                                                                                                                • UnhandledExceptionFilter.KERNEL32(?), ref: 006994F4
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 254469556-0
                                                                                                                                                                • Opcode ID: 01034c29f3f5d35e40005986729cdffddf8e8ccd77d60387fec00a6284d70522
                                                                                                                                                                • Instruction ID: 7dd8c98bfd4a6de3facb8b987e3408809c00601c069716370294c0e90ec512dc
                                                                                                                                                                • Opcode Fuzzy Hash: 01034c29f3f5d35e40005986729cdffddf8e8ccd77d60387fec00a6284d70522
                                                                                                                                                                • Instruction Fuzzy Hash: 1E313875D0221C9BDF51EFA4D989BCDBBB8BF08304F1040AAE40CAB250EB719B858F55
                                                                                                                                                                Function 0066E610 Relevance: 1.5, APIs: 1, Instructions: 6encryptionCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseCrypt
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1563465135-0
                                                                                                                                                                • Opcode ID: 3511135ed8a29f6bb58765a39e51aa7973049eb13e32a84f34c02a184adc353d
                                                                                                                                                                • Instruction ID: 7ec585df02d1b98feba6f27edd513711945f5567aea672d29c99b034e65b580b
                                                                                                                                                                • Opcode Fuzzy Hash: 3511135ed8a29f6bb58765a39e51aa7973049eb13e32a84f34c02a184adc353d
                                                                                                                                                                • Instruction Fuzzy Hash: 84B01270600101479F408B7AC90C88132595A0074131840446100C1050D625C800CD18
                                                                                                                                                                Function 00686AB0 Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 167libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00686AB6
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00686AC4
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00686AD5
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00686AE6
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00686AF7
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00686B08
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 00686B19
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00686B2A
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,CreateSemaphoreW), ref: 00686B3B
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00686B4C
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00686B5D
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00686B6E
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00686B7F
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00686B90
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00686BA1
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00686BB2
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00686BC3
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 00686BD4
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 00686BE5
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 00686BF6
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 00686C07
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 00686C18
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 00686C29
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleEx), ref: 00686C3A
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,SetFileInformationByHandle), ref: 00686C4B
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00686C5C
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00686C6D
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,WakeConditionVariable), ref: 00686C7E
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00686C8F
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00686CA0
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,InitializeSRWLock), ref: 00686CB1
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00686CC2
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,TryAcquireSRWLockExclusive), ref: 00686CD3
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00686CE4
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,SleepConditionVariableSRW), ref: 00686CF5
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,CreateThreadpoolWork), ref: 00686D06
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,SubmitThreadpoolWork), ref: 00686D17
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,CloseThreadpoolWork), ref: 00686D28
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 00686D39
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 00686D4A
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 00686D5B
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressProc$HandleModule
                                                                                                                                                                • String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
                                                                                                                                                                • API String ID: 667068680-295688737
                                                                                                                                                                • Opcode ID: 0e6d42d86b101183e2150674125f668b427e4b7e4a97811d6e4325742f8e588a
                                                                                                                                                                • Instruction ID: ea779dfa1d47240ae402585f7289d1af391fcbb5ba01043b4dc7eb8265952ef7
                                                                                                                                                                • Opcode Fuzzy Hash: 0e6d42d86b101183e2150674125f668b427e4b7e4a97811d6e4325742f8e588a
                                                                                                                                                                • Instruction Fuzzy Hash: B2618571E97360ABD704AFB9AC4D9963FBABA09702305D82BF101D71A1D7FA4051CF68
                                                                                                                                                                Function 0068E2B1 Relevance: 86.2, APIs: 32, Strings: 17, Instructions: 449COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __EH_prolog3.LIBCMT ref: 0068E2B8
                                                                                                                                                                • ctype.LIBCPMT ref: 0068E2FF
                                                                                                                                                                  • Part of subcall function 00623055: __Getctype.LIBCPMT ref: 00623064
                                                                                                                                                                  • Part of subcall function 00687FAF: __EH_prolog3.LIBCMT ref: 00687FB6
                                                                                                                                                                  • Part of subcall function 00687FAF: std::_Lockit::_Lockit.LIBCPMT ref: 00687FC0
                                                                                                                                                                  • Part of subcall function 00687FAF: std::_Lockit::~_Lockit.LIBCPMT ref: 00688031
                                                                                                                                                                • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0068E30D
                                                                                                                                                                • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0068E324
                                                                                                                                                                • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0068E36B
                                                                                                                                                                • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0068E39E
                                                                                                                                                                • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0068E3F0
                                                                                                                                                                • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0068E405
                                                                                                                                                                • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0068E424
                                                                                                                                                                • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0068E443
                                                                                                                                                                • collate.LIBCPMT ref: 0068E44D
                                                                                                                                                                • __Getcoll.LIBCPMT ref: 0068E48F
                                                                                                                                                                • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0068E4BA
                                                                                                                                                                • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0068E4FB
                                                                                                                                                                • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0068E510
                                                                                                                                                                • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0068E559
                                                                                                                                                                • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0068E58C
                                                                                                                                                                • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0068E5E7
                                                                                                                                                                • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0068E643
                                                                                                                                                                • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0068E696
                                                                                                                                                                  • Part of subcall function 00688203: __EH_prolog3.LIBCMT ref: 0068820A
                                                                                                                                                                  • Part of subcall function 00688203: std::_Lockit::_Lockit.LIBCPMT ref: 00688214
                                                                                                                                                                  • Part of subcall function 00688203: std::_Lockit::~_Lockit.LIBCPMT ref: 00688285
                                                                                                                                                                • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0068E6B5
                                                                                                                                                                • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0068E707
                                                                                                                                                                • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0068E74C
                                                                                                                                                                • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0068E761
                                                                                                                                                                  • Part of subcall function 006887D5: __EH_prolog3.LIBCMT ref: 006887DC
                                                                                                                                                                  • Part of subcall function 006887D5: std::_Lockit::_Lockit.LIBCPMT ref: 006887E6
                                                                                                                                                                  • Part of subcall function 006887D5: std::_Lockit::~_Lockit.LIBCPMT ref: 00688857
                                                                                                                                                                • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0068E780
                                                                                                                                                                  • Part of subcall function 00687C31: __EH_prolog3.LIBCMT ref: 00687C38
                                                                                                                                                                  • Part of subcall function 00687C31: std::_Lockit::_Lockit.LIBCPMT ref: 00687C42
                                                                                                                                                                  • Part of subcall function 00687C31: std::_Lockit::~_Lockit.LIBCPMT ref: 00687CB3
                                                                                                                                                                • codecvt.LIBCPMT ref: 0068E7B5
                                                                                                                                                                • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0068E7BF
                                                                                                                                                                  • Part of subcall function 006886AB: __EH_prolog3.LIBCMT ref: 006886B2
                                                                                                                                                                  • Part of subcall function 006886AB: std::_Lockit::_Lockit.LIBCPMT ref: 006886BC
                                                                                                                                                                  • Part of subcall function 006886AB: std::_Lockit::~_Lockit.LIBCPMT ref: 0068872D
                                                                                                                                                                • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0068E677
                                                                                                                                                                  • Part of subcall function 00685688: Concurrency::cancel_current_task.LIBCPMT ref: 00685748
                                                                                                                                                                  • Part of subcall function 00685688: __EH_prolog3.LIBCMT ref: 00685755
                                                                                                                                                                  • Part of subcall function 00685688: std::locale::_Locimp::_Makeloc.LIBCPMT ref: 00685781
                                                                                                                                                                  • Part of subcall function 00685688: std::_Locinfo::~_Locinfo.LIBCPMT ref: 0068578C
                                                                                                                                                                  • Part of subcall function 00688298: __EH_prolog3.LIBCMT ref: 0068829F
                                                                                                                                                                  • Part of subcall function 00688298: std::_Lockit::_Lockit.LIBCPMT ref: 006882A9
                                                                                                                                                                  • Part of subcall function 00688298: std::_Lockit::~_Lockit.LIBCPMT ref: 0068831A
                                                                                                                                                                • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0068E658
                                                                                                                                                                  • Part of subcall function 00685688: __EH_prolog3.LIBCMT ref: 0068568F
                                                                                                                                                                  • Part of subcall function 00685688: std::_Lockit::_Lockit.LIBCPMT ref: 00685699
                                                                                                                                                                  • Part of subcall function 00685688: std::_Lockit::~_Lockit.LIBCPMT ref: 0068573D
                                                                                                                                                                  • Part of subcall function 006880D9: __EH_prolog3.LIBCMT ref: 006880E0
                                                                                                                                                                  • Part of subcall function 006880D9: std::_Lockit::_Lockit.LIBCPMT ref: 006880EA
                                                                                                                                                                  • Part of subcall function 006880D9: std::_Lockit::~_Lockit.LIBCPMT ref: 0068815B
                                                                                                                                                                • numpunct.LIBCPMT ref: 0068E6F7
                                                                                                                                                                • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0068E4A3
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::_Lockit.LIBCPMT ref: 00622D30
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00622D4C
                                                                                                                                                                • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0068E7D4
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Locimp::_std::locale::_$AddfacLocimp_$std::_$Lockit$H_prolog3$Lockit::_Lockit::~_$Concurrency::cancel_current_taskGetcollGetctypeLocinfoLocinfo::~_Makeloccodecvtcollatectypenumpunct
                                                                                                                                                                • String ID: @sq$Dsq$Dsq$Hsq$Hsq$Lsq$Psq$Tsq$Xsq$Xsq$\sq$\sq$`sq$`sq$dsq$hsq$hsq
                                                                                                                                                                • API String ID: 3784148211-2718945443
                                                                                                                                                                • Opcode ID: b17f3a0b2add42036e0108c449b30852da7efd3b9bd2b8fa5bc947d695dd68a4
                                                                                                                                                                • Instruction ID: 1b1fcb886efa00d764871c810753c6003cffa9681229670110e4529d6b23ab61
                                                                                                                                                                • Opcode Fuzzy Hash: b17f3a0b2add42036e0108c449b30852da7efd3b9bd2b8fa5bc947d695dd68a4
                                                                                                                                                                • Instruction Fuzzy Hash: 38E1D4B0D01216AFDB647F648846ABF3AABDF42354F14462DF8056B381EB364D4097E6
                                                                                                                                                                Function 00670780 Relevance: 30.0, APIs: 2, Strings: 15, Instructions: 250COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Strings
                                                                                                                                                                • NWebAdvisor::NXmlUpdater::CExtractCabLocalCommand::ExecuteExtractCabLocalCommand, xrefs: 0067095D, 006709A2, 006709D9, 00670A14
                                                                                                                                                                • Failed to delete src cab (%d), xrefs: 00670A0D
                                                                                                                                                                • invalid substitutor, xrefs: 006707C5
                                                                                                                                                                • DestDir, xrefs: 00670813
                                                                                                                                                                • NWebAdvisor::NXmlUpdater::CExtractCabLocalCommand::Execute, xrefs: 006708E0, 00670A44
                                                                                                                                                                • Unable to create destination directory (%d), xrefs: 0067099B
                                                                                                                                                                • Failed to parse DeleteFile as a boolean - default to false, xrefs: 006708D9
                                                                                                                                                                • c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\ExtractCabLocalCommand.cpp, xrefs: 006708E5, 00670962, 006709A7, 006709DE, 00670A19, 00670A49
                                                                                                                                                                • Unable to read Source and/or DestDir attribute of EXTRACT_CAB_LOCAL command, xrefs: 00670A3D, 00670A42
                                                                                                                                                                • DeleteFile, xrefs: 0067086B
                                                                                                                                                                • Unable to verify signature for file: %s, xrefs: 00670956
                                                                                                                                                                • Failed to extract cab (%s), xrefs: 006709D2
                                                                                                                                                                • Unable to substitute DeleteFile attribute, xrefs: 006708BC
                                                                                                                                                                • Unable to substitute variables for the EXTRACT_CAB_LOCAL command, xrefs: 00670A31
                                                                                                                                                                • Source, xrefs: 006707D1
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID: DeleteFile$DestDir$Failed to delete src cab (%d)$Failed to extract cab (%s)$Failed to parse DeleteFile as a boolean - default to false$NWebAdvisor::NXmlUpdater::CExtractCabLocalCommand::Execute$NWebAdvisor::NXmlUpdater::CExtractCabLocalCommand::ExecuteExtractCabLocalCommand$Source$Unable to create destination directory (%d)$Unable to read Source and/or DestDir attribute of EXTRACT_CAB_LOCAL command$Unable to substitute DeleteFile attribute$Unable to substitute variables for the EXTRACT_CAB_LOCAL command$Unable to verify signature for file: %s$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\ExtractCabLocalCommand.cpp$invalid substitutor
                                                                                                                                                                • API String ID: 0-2605792675
                                                                                                                                                                • Opcode ID: 1df95c22a397ea4933c158350562f2e7edc571667f90423f030b71cd169d2614
                                                                                                                                                                • Instruction ID: b7bb7ab96e5c6ec021a3a080a3f2309f0ea50d7eb689b084d7b681e7dbc7d609
                                                                                                                                                                • Opcode Fuzzy Hash: 1df95c22a397ea4933c158350562f2e7edc571667f90423f030b71cd169d2614
                                                                                                                                                                • Instruction Fuzzy Hash: 8891FE70A41304EBEB10EF91D852BEEBB77AF15705F004019F9096B382EB75A948CBB5
                                                                                                                                                                Function 0063A118 Relevance: 28.3, APIs: 10, Strings: 6, Instructions: 273COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 0063DE80: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0063DF0C
                                                                                                                                                                • __Mtx_unlock.LIBCPMT ref: 0063A143
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0063A1AA
                                                                                                                                                                  • Part of subcall function 0063E0D0: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0063E161
                                                                                                                                                                • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 0063A1C1
                                                                                                                                                                • CloseHandle.KERNEL32(?), ref: 0063A1DD
                                                                                                                                                                • CreateSemaphoreW.KERNEL32(00000000,00000000,000003E8,00000000), ref: 0063A24C
                                                                                                                                                                • CloseHandle.KERNEL32(?), ref: 0063A268
                                                                                                                                                                • ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,00000000), ref: 0063A410
                                                                                                                                                                • GetLastError.KERNEL32(?,00000001), ref: 0063A46F
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Ios_base_dtorstd::ios_base::_$CloseCreateHandleSemaphore$ErrorEventLastMtx_unlockRelease
                                                                                                                                                                • String ID: E$Failed to create event semaphore$Failed to create stop event$Failed to initialize event sender$Failed to release semaphore. Error: $V
                                                                                                                                                                • API String ID: 1380281556-3274429967
                                                                                                                                                                • Opcode ID: 9897c723da23840efaf1a602b26a605378e29dfef6a6ee7f8f55ee601a9dff7f
                                                                                                                                                                • Instruction ID: b7b83107db476849361a5b4b334c11b2ad03248e0abe080d6e2db029a9df4d1d
                                                                                                                                                                • Opcode Fuzzy Hash: 9897c723da23840efaf1a602b26a605378e29dfef6a6ee7f8f55ee601a9dff7f
                                                                                                                                                                • Instruction Fuzzy Hash: CBB1F270A006099BDB44EFA0DC56BEEB7B7FF44310F00426DE8196B281EB716A45CF96
                                                                                                                                                                Function 00670FA0 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 141filelibraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleHandleW.KERNEL32(kernel32.dll,D8276B9A,000000FF,00000000,00000000,006CDF30,000000FF), ref: 00670FE8
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,CreateFileTransactedW), ref: 00670FF8
                                                                                                                                                                • CreateFileW.KERNEL32(000000FF,00000001,00000001,00000000,00000003,00000080,00000000,D8276B9A,000000FF,00000000,00000000,006CDF30,000000FF), ref: 00671037
                                                                                                                                                                • GetLastError.KERNEL32 ref: 00671058
                                                                                                                                                                • GetFileSize.KERNEL32(?,?), ref: 00671088
                                                                                                                                                                • CreateFileMappingW.KERNEL32(?,00000000,00000002,?,00000000,00000000), ref: 0067109C
                                                                                                                                                                • MapViewOfFileEx.KERNEL32(00000000,00000004,00000000,00000000,?,00000000), ref: 006710D9
                                                                                                                                                                • CloseHandle.KERNEL32(?), ref: 006710F0
                                                                                                                                                                Strings
                                                                                                                                                                • kernel32.dll, xrefs: 00670FE3
                                                                                                                                                                • Failed to open the file: %d, xrefs: 0067105F
                                                                                                                                                                • CreateFileTransactedW, xrefs: 00670FF2
                                                                                                                                                                • c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\FileMemMap.h, xrefs: 0067106B, 0067110D
                                                                                                                                                                • NWebAdvisor::CFileMemMap::Init, xrefs: 00671066, 00671108
                                                                                                                                                                • Failed to map file to memory, xrefs: 00671101
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$CreateHandle$AddressCloseErrorLastMappingModuleProcSizeView
                                                                                                                                                                • String ID: CreateFileTransactedW$Failed to map file to memory$Failed to open the file: %d$NWebAdvisor::CFileMemMap::Init$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\FileMemMap.h$kernel32.dll
                                                                                                                                                                • API String ID: 2423579280-2843467768
                                                                                                                                                                • Opcode ID: aa6b20d81dabd61a2693b4e834edbcbe1fd44877f120fd7c7651a02cc21bc34d
                                                                                                                                                                • Instruction ID: b06bf4c344647d70e1240faeac7fe8b5c9841e9d7f351f9001c48bdf4124b2f2
                                                                                                                                                                • Opcode Fuzzy Hash: aa6b20d81dabd61a2693b4e834edbcbe1fd44877f120fd7c7651a02cc21bc34d
                                                                                                                                                                • Instruction Fuzzy Hash: C041A970B40341BFEB209F64CC46F6977A6BF15B10F10861AFA15EF2C1DBB5A9408BA4
                                                                                                                                                                Function 0063E843 Relevance: 23.1, APIs: 6, Strings: 7, Instructions: 319COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00629BB0: InitOnceBeginInitialize.KERNEL32(007180C4,00000000,D8276B9A,00000000,D8276B9A,0062A219,007180CC,?,?,?,?,?,?,0062A219,?,?), ref: 00629BE5
                                                                                                                                                                  • Part of subcall function 00629BB0: InitOnceComplete.KERNEL32(007180C4,00000000,00000000), ref: 00629C1D
                                                                                                                                                                  • Part of subcall function 00629940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00629A12
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0063E8A8
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: InitIos_base_dtorOncestd::ios_base::_$BeginCompleteInitialize
                                                                                                                                                                • String ID: Authorization: $Failed to create access token$HTTP receive response failed for Azure: $HTTP send request failed for Azure: $HTTP status error for Azure: $`avo$`o
                                                                                                                                                                • API String ID: 539357862-2278809163
                                                                                                                                                                • Opcode ID: 66fae7fa6449e0b3549e2b096c9dc84b3970bd34393b9f9c45a6e6526e51414e
                                                                                                                                                                • Instruction ID: 2570e4cc03b54d69c961fe2ac78a6e801c3ad4a7ba102417d45caffa6fc865b2
                                                                                                                                                                • Opcode Fuzzy Hash: 66fae7fa6449e0b3549e2b096c9dc84b3970bd34393b9f9c45a6e6526e51414e
                                                                                                                                                                • Instruction Fuzzy Hash: 42D1BF30A0022DCBDB64EB60DD55BEDB77AAF45304F4044DCE509AB281DB71AB88CFA5
                                                                                                                                                                Function 00672FD0 Relevance: 22.9, APIs: 3, Strings: 10, Instructions: 177registryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RegOpenKeyExW.ADVAPI32(80000002,00000000,00000000,?,00000000,00000028,00000028,00000000,00000000,Name,00000004,00000000,00000000,Key,00000003,D8276B9A), ref: 006730F1
                                                                                                                                                                • RegCloseKey.ADVAPI32(00000008), ref: 0067317C
                                                                                                                                                                Strings
                                                                                                                                                                • c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\delete_registry_value_command.cpp, xrefs: 00673108, 00673163, 006731A9, 006731D1
                                                                                                                                                                • Error opening HKLM registry key: %d, xrefs: 006730FC
                                                                                                                                                                • Invalid substitutor, xrefs: 00673005
                                                                                                                                                                • Key, xrefs: 00673013
                                                                                                                                                                • Unable to read Key or Name for DEL_REG_VALUE command, xrefs: 006731C5
                                                                                                                                                                • Cannnot delete registry value. Key or value not found. Key: %s Value: %s, xrefs: 00673157
                                                                                                                                                                • Name, xrefs: 00673055
                                                                                                                                                                • NWebAdvisor::NXmlUpdater::parse_and_execute, xrefs: 00673103, 0067315E, 006731A4, 006731CC
                                                                                                                                                                • Unable to substitute variables for the DEL_REG_VALUE command, xrefs: 006731BC
                                                                                                                                                                • Error (%d) deleting registry value (%s) in key: %s, xrefs: 0067319D
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseOpen
                                                                                                                                                                • String ID: Cannnot delete registry value. Key or value not found. Key: %s Value: %s$Error (%d) deleting registry value (%s) in key: %s$Error opening HKLM registry key: %d$Invalid substitutor$Key$NWebAdvisor::NXmlUpdater::parse_and_execute$Name$Unable to read Key or Name for DEL_REG_VALUE command$Unable to substitute variables for the DEL_REG_VALUE command$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\delete_registry_value_command.cpp
                                                                                                                                                                • API String ID: 47109696-1081640057
                                                                                                                                                                • Opcode ID: 2f0b18161740fa776fae6dcfb7bab1254111996fea2d5b8adf6171a40097e12d
                                                                                                                                                                • Instruction ID: 44dfb8d75e697c4525da5391ceb908519f5b61c32509c167b14f1bb90ebc7313
                                                                                                                                                                • Opcode Fuzzy Hash: 2f0b18161740fa776fae6dcfb7bab1254111996fea2d5b8adf6171a40097e12d
                                                                                                                                                                • Instruction Fuzzy Hash: FC51DF70A42319ABDB10DF91DC4ABAFB7BBAF05704F904118F9047B381DB74AA04CBA4
                                                                                                                                                                Function 00658400 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 152COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SHGetSpecialFolderPathW.SHELL32(00000000,0070F278,00000023,00000001,00000004,00000000,00000000), ref: 00658462
                                                                                                                                                                • CreateDirectoryW.KERNEL32(0070F278,00000000,0070F278,00000104,\McAfee\), ref: 00658491
                                                                                                                                                                • GetLastError.KERNEL32 ref: 0065849D
                                                                                                                                                                • CreateDirectoryW.KERNEL32(0070F278,00000000,0070F278,00000104,0070F070), ref: 006584C5
                                                                                                                                                                • GetLastError.KERNEL32 ref: 006584CB
                                                                                                                                                                • GetModuleFileNameW.KERNEL32(?,00000104), ref: 006584FC
                                                                                                                                                                • StrRChrW.SHLWAPI(?,00000000,0000005C), ref: 00658511
                                                                                                                                                                • CreateDirectoryW.KERNEL32(0070F278,00000000,0070F278,00000104,00000000), ref: 0065852E
                                                                                                                                                                • GetLastError.KERNEL32 ref: 00658534
                                                                                                                                                                • GetTickCount.KERNEL32 ref: 006585B9
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateDirectoryErrorLast$CountFileFolderModuleNamePathSpecialTick
                                                                                                                                                                • String ID: %uFile:%sFunction:%sLine:%d$\McAfee\$\log.txt
                                                                                                                                                                • API String ID: 922589859-3713371193
                                                                                                                                                                • Opcode ID: cf0a288a2d72e611a142e3401fba94cbd0c7a24e1e7cafe54def6660f349d6dd
                                                                                                                                                                • Instruction ID: 61548405c853c05c4da4b87410e897e2240c3270e7d180c72d6a3dce42de758a
                                                                                                                                                                • Opcode Fuzzy Hash: cf0a288a2d72e611a142e3401fba94cbd0c7a24e1e7cafe54def6660f349d6dd
                                                                                                                                                                • Instruction Fuzzy Hash: 5951E7B5A80318EFDF20EB65DC4AFDD73A6AB14700F1002A5FD04B76D1DEB49A848B95
                                                                                                                                                                Function 00662B30 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 107libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • LoadLibraryW.KERNEL32(?,D8276B9A,00000000,?,00000000,?,00663AE3,00000000,00000000,?,00000000,811C9DC5,path,00000004,?), ref: 00662B73
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,Dispatcher), ref: 00662B98
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,Controller), ref: 00662BA7
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,Release), ref: 00662BC8
                                                                                                                                                                • FreeLibrary.KERNEL32(00000000), ref: 00662C46
                                                                                                                                                                • FreeLibrary.KERNEL32(00000000), ref: 00662CC3
                                                                                                                                                                • GetLastError.KERNEL32(?,00663AE3,00000000,00000000,?,00000000,811C9DC5,path,00000004), ref: 00662CCB
                                                                                                                                                                Strings
                                                                                                                                                                • Release, xrefs: 00662BC2
                                                                                                                                                                • NWebAdvisor::NXmlUpdater::InternalImpl::GetInstance, xrefs: 00662CDF
                                                                                                                                                                • Dispatcher, xrefs: 00662B92
                                                                                                                                                                • Failed to load library %s. Error 0x%08X, xrefs: 00662CD5
                                                                                                                                                                • c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\Hound.cpp, xrefs: 00662CE4
                                                                                                                                                                • Controller, xrefs: 00662B9E
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressLibraryProc$Free$ErrorLastLoad
                                                                                                                                                                • String ID: Controller$Dispatcher$Failed to load library %s. Error 0x%08X$NWebAdvisor::NXmlUpdater::InternalImpl::GetInstance$Release$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\Hound.cpp
                                                                                                                                                                • API String ID: 2058215185-435243658
                                                                                                                                                                • Opcode ID: 902f293fd443cbdff44f3caa84dbe84edeae8dea97acf2220e78c976134ff1de
                                                                                                                                                                • Instruction ID: 79c067db3fb5929d0542d9ba375346024586787d20f55737566b5f6d568a33c4
                                                                                                                                                                • Opcode Fuzzy Hash: 902f293fd443cbdff44f3caa84dbe84edeae8dea97acf2220e78c976134ff1de
                                                                                                                                                                • Instruction Fuzzy Hash: FC4178B0E01315DFDB009FA9C954B9EBBF5FF18710F01816AE405AB292DBB58900CFA5
                                                                                                                                                                Function 006ACE60 Relevance: 22.9, APIs: 15, Instructions: 357COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _free$Info
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2509303402-0
                                                                                                                                                                • Opcode ID: 1c2918e37a22f000e2919b586b4c29f5a32131d44179bbaede648f60d3205c6c
                                                                                                                                                                • Instruction ID: 4c2240e3b5aff83b828b36b9939ed723384cdda160406a2f5d3ee6abc2938b34
                                                                                                                                                                • Opcode Fuzzy Hash: 1c2918e37a22f000e2919b586b4c29f5a32131d44179bbaede648f60d3205c6c
                                                                                                                                                                • Instruction Fuzzy Hash: BFD17DB19003059FDB21AFB8C881BEEBBF6BF49300F14456DE996AB342D671AD45CB50
                                                                                                                                                                Function 00660950 Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 244fileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00660490: CreateDirectoryW.KERNEL32(?,00000000,?), ref: 006604AA
                                                                                                                                                                  • Part of subcall function 00660490: GetLastError.KERNEL32 ref: 006604B8
                                                                                                                                                                • CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,00000000,00000000,00000000,0000005C,00000001,00000000), ref: 00660BB5
                                                                                                                                                                • GetLastError.KERNEL32 ref: 00660BC2
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateErrorLast$DirectoryFile
                                                                                                                                                                • String ID: _e$CreateDir failed for %s$CreateFile failed for %s: %d$NWebAdvisor::NUtils::StoreBufferInFile$WriteFile failed: %d$\$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\FileUtils.cpp
                                                                                                                                                                • API String ID: 1552088572-1820108964
                                                                                                                                                                • Opcode ID: 99110faa1e5e9b48c04ffc361d2fd8af142ca370f26868918c1ae5a8736ea646
                                                                                                                                                                • Instruction ID: 3bcaa956732dab025960d1f3f2a2622c733e11561bfe8e400e302bd3b992af7f
                                                                                                                                                                • Opcode Fuzzy Hash: 99110faa1e5e9b48c04ffc361d2fd8af142ca370f26868918c1ae5a8736ea646
                                                                                                                                                                • Instruction Fuzzy Hash: D0A19C70E00359DEEF00DFA4CC45BEEBBB6AF58314F144219E9057B281EBB16A85CB61
                                                                                                                                                                Function 00673300 Relevance: 21.2, APIs: 3, Strings: 9, Instructions: 217registryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RegCloseKey.ADVAPI32(00000000), ref: 00673545
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Close
                                                                                                                                                                • String ID: Cannnot delete registry key. Not found: %s$Error (%d) deleting registry key tree: %s$Error opening HKLM registry key: %d$Invalid substitutor$Key$NWebAdvisor::NXmlUpdater::parse_and_execute$Unable to read Key for DEL_REG_TREE command$Unable to substitute variables for the DEL_REG_TREE command$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\delete_registry_tree_command.cpp
                                                                                                                                                                • API String ID: 3535843008-3762851336
                                                                                                                                                                • Opcode ID: 7590b14729f98d03bc0a399fe82a5dc4a385feb4f05cce9adf4d9ff41869f124
                                                                                                                                                                • Instruction ID: 81ba99b7152e5eaf4fa39127a4f5479e8bc23ab5d8f0fd8159052ab599261555
                                                                                                                                                                • Opcode Fuzzy Hash: 7590b14729f98d03bc0a399fe82a5dc4a385feb4f05cce9adf4d9ff41869f124
                                                                                                                                                                • Instruction Fuzzy Hash: 81711531A41325AFDF259F65C842BEEB7B7AF04B00F558158E9087B3C1DB71AA04DBA0
                                                                                                                                                                Function 006BB4F0 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 200COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _free
                                                                                                                                                                • String ID: xxq$xxq$|xq
                                                                                                                                                                • API String ID: 269201875-503824282
                                                                                                                                                                • Opcode ID: f15e2cab70738601a87b4e19f350b0b17ed982ea760549d1b734cff520e67853
                                                                                                                                                                • Instruction ID: 86f04fb9c837a6c1c7b52871fb012a4aec714824da2f50a4179d6c910b4e5d6d
                                                                                                                                                                • Opcode Fuzzy Hash: f15e2cab70738601a87b4e19f350b0b17ed982ea760549d1b734cff520e67853
                                                                                                                                                                • Instruction Fuzzy Hash: 8C61D4B2900705DFDB20DF78C841BEA77EAAF44310F205569E945EB382EBB09D80CB54
                                                                                                                                                                Function 006987E7 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 58libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • InitializeCriticalSectionAndSpinCount.KERNEL32(0071742C,00000FA0,?,?,006987C5), ref: 006987F3
                                                                                                                                                                • GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,006987C5), ref: 006987FE
                                                                                                                                                                • GetModuleHandleW.KERNEL32(kernel32.dll,?,?,006987C5), ref: 0069880F
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00698821
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 0069882F
                                                                                                                                                                • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,006987C5), ref: 00698852
                                                                                                                                                                • DeleteCriticalSection.KERNEL32(0071742C,00000007,?,?,006987C5), ref: 00698875
                                                                                                                                                                • CloseHandle.KERNEL32(00000000,?,?,006987C5), ref: 00698885
                                                                                                                                                                Strings
                                                                                                                                                                • kernel32.dll, xrefs: 0069880A
                                                                                                                                                                • api-ms-win-core-synch-l1-2-0.dll, xrefs: 006987F9
                                                                                                                                                                • SleepConditionVariableCS, xrefs: 0069881B
                                                                                                                                                                • WakeAllConditionVariable, xrefs: 00698827
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
                                                                                                                                                                • String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
                                                                                                                                                                • API String ID: 2565136772-3242537097
                                                                                                                                                                • Opcode ID: ccf8921f8cacc2c639dd80a31954f0d912fab640954f8dabd076f868a51eec39
                                                                                                                                                                • Instruction ID: 619db8ff465ae48f81831cf915a050ce94f514c015e4f2658027b68f6045d543
                                                                                                                                                                • Opcode Fuzzy Hash: ccf8921f8cacc2c639dd80a31954f0d912fab640954f8dabd076f868a51eec39
                                                                                                                                                                • Instruction Fuzzy Hash: 0001D831F467115FDB202B79BD09A963FAFAB81B407055421FD05D7690DEB5C800C635
                                                                                                                                                                Function 006BB0D0 Relevance: 18.4, APIs: 12, Instructions: 374COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _free
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 269201875-0
                                                                                                                                                                • Opcode ID: 6e57740e5fbb627f22588cb962715e364686a4bfdd2409dd8f8c6152f8925219
                                                                                                                                                                • Instruction ID: 21bec5cec6b275671324ec0432568deba72f049c1b4a6c23a8c89f1f410bb21a
                                                                                                                                                                • Opcode Fuzzy Hash: 6e57740e5fbb627f22588cb962715e364686a4bfdd2409dd8f8c6152f8925219
                                                                                                                                                                • Instruction Fuzzy Hash: 50C147B5D44605AFDB60DBA8CC82FEE77FDAF04700F144569FA05FB282D6B09A818794
                                                                                                                                                                Function 006591A0 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 150COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleHandleW.KERNEL32(kernel32.dll,006FA536,00000003), ref: 006591C9
                                                                                                                                                                • FindResourceW.KERNEL32(00000000,00000001,00000010), ref: 006591DE
                                                                                                                                                                • LoadResource.KERNEL32(00000000,00000000), ref: 006591EE
                                                                                                                                                                • LockResource.KERNEL32(00000000), ref: 006591FD
                                                                                                                                                                Strings
                                                                                                                                                                • kernel32.dll, xrefs: 006591B8
                                                                                                                                                                • Failed to format version, xrefs: 00659275
                                                                                                                                                                • c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\SubstitutionManager.cpp, xrefs: 00659284, 0065933B
                                                                                                                                                                • %d.%d.%d.%d, xrefs: 0065925E
                                                                                                                                                                • Failed to retrieve kernel verison, xrefs: 0065932C
                                                                                                                                                                • NWebAdvisor::NXmlUpdater::CSubstitutionManager::GetOsVersion, xrefs: 0065927F, 00659336
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Resource$FindHandleLoadLockModule
                                                                                                                                                                • String ID: %d.%d.%d.%d$Failed to format version$Failed to retrieve kernel verison$NWebAdvisor::NXmlUpdater::CSubstitutionManager::GetOsVersion$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\SubstitutionManager.cpp$kernel32.dll
                                                                                                                                                                • API String ID: 3968257194-3470154288
                                                                                                                                                                • Opcode ID: 14cc9713314d860e4a9d28a6ba9ab78184c17b1322aae0186c60e051f8e32c9f
                                                                                                                                                                • Instruction ID: 5ff1081fde660c30de0cfc66de9ea4dde5ea5cd9a4b560a5d85b0c544296b1eb
                                                                                                                                                                • Opcode Fuzzy Hash: 14cc9713314d860e4a9d28a6ba9ab78184c17b1322aae0186c60e051f8e32c9f
                                                                                                                                                                • Instruction Fuzzy Hash: 7F511970A01314DBCF24AF25CC45BAB77B6EF04705F40059DEC06AB792DB759A45CBA4
                                                                                                                                                                Function 0069C338 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • IsInExceptionSpec.LIBVCRUNTIME ref: 0069C435
                                                                                                                                                                • type_info::operator==.LIBVCRUNTIME ref: 0069C457
                                                                                                                                                                • ___TypeMatch.LIBVCRUNTIME ref: 0069C566
                                                                                                                                                                • IsInExceptionSpec.LIBVCRUNTIME ref: 0069C638
                                                                                                                                                                • _UnwindNestedFrames.LIBCMT ref: 0069C6BC
                                                                                                                                                                • CallUnexpected.LIBVCRUNTIME ref: 0069C6D7
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
                                                                                                                                                                • String ID: csm$csm$csm
                                                                                                                                                                • API String ID: 2123188842-393685449
                                                                                                                                                                • Opcode ID: 3fd49da49f68058b34e53e787a9573aca6b2652730ef4d776b99ea280eeda832
                                                                                                                                                                • Instruction ID: 5ff5e83fcec9130b2f2a1b8395df3e4a0cc89a0458c028bc009ae8612edfcdc5
                                                                                                                                                                • Opcode Fuzzy Hash: 3fd49da49f68058b34e53e787a9573aca6b2652730ef4d776b99ea280eeda832
                                                                                                                                                                • Instruction Fuzzy Hash: AAB18A71900209EFCF14DFA4C9819AEBBBABF54320F14415AE8156BB52D330EA61CFA5
                                                                                                                                                                Function 006369A0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 114libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • DeviceIoControl.KERNEL32(D8276B9A,9EDBA51C,00000000,00000000,00000000,00000000,?,00000000), ref: 006369E9
                                                                                                                                                                • CloseHandle.KERNEL32(D8276B9A,?,?,00000000), ref: 006369FB
                                                                                                                                                                • DeviceIoControl.KERNEL32(00000000,9EDB651C,00000000,00000000,00000000,00000000,?,00000000), ref: 00636A2A
                                                                                                                                                                • CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 00636A3D
                                                                                                                                                                • GetModuleHandleExW.KERNEL32(00000000,mfeaaca.dll,?), ref: 00636A8B
                                                                                                                                                                • GetProcAddress.KERNEL32(?,NotComDllUnload), ref: 00636A9E
                                                                                                                                                                • FreeLibrary.KERNEL32(00000000), ref: 00636AB8
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Handle$CloseControlDevice$AddressFreeLibraryModuleProc
                                                                                                                                                                • String ID: NotComDllUnload$mfeaaca.dll
                                                                                                                                                                • API String ID: 2321898493-1077453148
                                                                                                                                                                • Opcode ID: c693b2332cfdf0a15e27213f98e0abf1226c0659eb2f578d539805f052c787c3
                                                                                                                                                                • Instruction ID: 54ceba622e730ae4fd4c47550be0e940aac7c2ff9445a644c4945e36e841a2f0
                                                                                                                                                                • Opcode Fuzzy Hash: c693b2332cfdf0a15e27213f98e0abf1226c0659eb2f578d539805f052c787c3
                                                                                                                                                                • Instruction Fuzzy Hash: 3B31B371700305ABDB24AF24DC89F6A7BAAEF44B11F148619F915EB3D0DB71EC04CAA1
                                                                                                                                                                Function 00674280 Relevance: 15.1, APIs: 3, Strings: 7, Instructions: 133COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                • c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\HttpTransaction_sacore.cpp, xrefs: 0067432A, 0067438D, 006743DD
                                                                                                                                                                • # SetAutoProxyUrl: Can't get proxy. Err: %d, xrefs: 00674381
                                                                                                                                                                • NWebAdvisor::CHttpTransaction::SetAutoProxyUrl, xrefs: 00674388
                                                                                                                                                                • Unable to set proxy option, error: %d, xrefs: 006743CE
                                                                                                                                                                • # SetAutoProxy: Can't get proxy. Err: %d, xrefs: 0067431E
                                                                                                                                                                • NWebAdvisor::CHttpTransaction::Connect, xrefs: 006743D8
                                                                                                                                                                • NWebAdvisor::CHttpTransaction::SetAutoProxy, xrefs: 00674325
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorLast
                                                                                                                                                                • String ID: # SetAutoProxy: Can't get proxy. Err: %d$# SetAutoProxyUrl: Can't get proxy. Err: %d$NWebAdvisor::CHttpTransaction::Connect$NWebAdvisor::CHttpTransaction::SetAutoProxy$NWebAdvisor::CHttpTransaction::SetAutoProxyUrl$Unable to set proxy option, error: %d$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\HttpTransaction_sacore.cpp
                                                                                                                                                                • API String ID: 1452528299-2881327693
                                                                                                                                                                • Opcode ID: 391cd0e83e3c79bbc3d0d902196f3209fe1ad4d2242c0253a2b5101e5b66a838
                                                                                                                                                                • Instruction ID: 5e6354096348cca55126b546845d2ace4370e150da2d98be2557c07f747fe37f
                                                                                                                                                                • Opcode Fuzzy Hash: 391cd0e83e3c79bbc3d0d902196f3209fe1ad4d2242c0253a2b5101e5b66a838
                                                                                                                                                                • Instruction Fuzzy Hash: CB418170E4031AEFEB10DFA9CC45BEEB7F9EF08714F008119E918A6280DBB59954CB64
                                                                                                                                                                Function 0069E00A Relevance: 14.5, APIs: 1, Strings: 7, Instructions: 496COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: __aulldvrm
                                                                                                                                                                • String ID: :$f$f$f$p$p$p
                                                                                                                                                                • API String ID: 1302938615-1434680307
                                                                                                                                                                • Opcode ID: cea7733dabf86bc5c6ea0c60d40b02c71f29b3b5f468f1def6264aa648266a2d
                                                                                                                                                                • Instruction ID: ebf225ff40331e77975ee947f0ab1d80e44a91ec7b3f8201d41d27db33f0e270
                                                                                                                                                                • Opcode Fuzzy Hash: cea7733dabf86bc5c6ea0c60d40b02c71f29b3b5f468f1def6264aa648266a2d
                                                                                                                                                                • Instruction Fuzzy Hash: D502A175A00218DADF20CFA4D4446EDB7BFFB14B14FA44196E414BBB80E7729E89CB16
                                                                                                                                                                Function 00696940 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 325COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __EH_prolog3.LIBCMT ref: 00696947
                                                                                                                                                                  • Part of subcall function 0064C960: std::_Lockit::_Lockit.LIBCPMT ref: 0064C995
                                                                                                                                                                  • Part of subcall function 0064C960: std::_Lockit::_Lockit.LIBCPMT ref: 0064C9B7
                                                                                                                                                                  • Part of subcall function 0064C960: std::_Lockit::~_Lockit.LIBCPMT ref: 0064C9D7
                                                                                                                                                                  • Part of subcall function 0064C960: std::_Lockit::~_Lockit.LIBCPMT ref: 0064CAB1
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
                                                                                                                                                                • String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
                                                                                                                                                                • API String ID: 1383202999-2891247106
                                                                                                                                                                • Opcode ID: 1c6dd3fcf2793c60453d2120d8304f321346ccaa03717ca9ddcbf35012b0242a
                                                                                                                                                                • Instruction ID: 5b7b6a54323c8b5fc8d41f313c8d146ac515763b001bef2d29b833a9948d9087
                                                                                                                                                                • Opcode Fuzzy Hash: 1c6dd3fcf2793c60453d2120d8304f321346ccaa03717ca9ddcbf35012b0242a
                                                                                                                                                                • Instruction Fuzzy Hash: A7B19D7150020AEBCF19DF68C965DFE3BBFEF19314F05411AFA42A6A51E631CA21DB20
                                                                                                                                                                Function 00670C80 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 244fileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,00000000,?,?,D8276B9A,00000000), ref: 00670E20
                                                                                                                                                                • GetLastError.KERNEL32 ref: 00670E2E
                                                                                                                                                                  • Part of subcall function 00670FA0: GetModuleHandleW.KERNEL32(kernel32.dll,D8276B9A,000000FF,00000000,00000000,006CDF30,000000FF), ref: 00670FE8
                                                                                                                                                                  • Part of subcall function 00670FA0: GetProcAddress.KERNEL32(00000000,CreateFileTransactedW), ref: 00670FF8
                                                                                                                                                                  • Part of subcall function 00670FA0: GetLastError.KERNEL32 ref: 00671058
                                                                                                                                                                  • Part of subcall function 00658650: std::locale::_Init.LIBCPMT ref: 0065882F
                                                                                                                                                                Strings
                                                                                                                                                                • Failed to load cab %s, xrefs: 00670F05
                                                                                                                                                                • CreateFile failed: %d, xrefs: 00670E35
                                                                                                                                                                • c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\CabParser.h, xrefs: 00670DA0, 00670E41, 00670F11
                                                                                                                                                                • NWebAdvisor::CCabParser::LoadCabFile, xrefs: 00670F0C
                                                                                                                                                                • Unable to create destination directory (%d), xrefs: 00670D94
                                                                                                                                                                • NWebAdvisor::CCabParser::GetContentFile, xrefs: 00670D9B, 00670E3C
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorLast$AddressCreateFileHandleInitModuleProcstd::locale::_
                                                                                                                                                                • String ID: CreateFile failed: %d$Failed to load cab %s$NWebAdvisor::CCabParser::GetContentFile$NWebAdvisor::CCabParser::LoadCabFile$Unable to create destination directory (%d)$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\CabParser.h
                                                                                                                                                                • API String ID: 1808632809-3418505487
                                                                                                                                                                • Opcode ID: 3392690d0a2f2e8414416e4993acfa54ee53ed48e2ca49c057c994dbca324c6f
                                                                                                                                                                • Instruction ID: 3e3b29dd5d797657a543ddb7d47d7f94ad811da23da37eef9ba1faabee3339ed
                                                                                                                                                                • Opcode Fuzzy Hash: 3392690d0a2f2e8414416e4993acfa54ee53ed48e2ca49c057c994dbca324c6f
                                                                                                                                                                • Instruction Fuzzy Hash: F1918071A00208DFDB14DFA4D896BEEB7BAEF04704F20852DE415AB282DB756A05CF64
                                                                                                                                                                Function 006BF5F9 Relevance: 13.8, APIs: 9, Instructions: 301COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: 53c063ff91e1417e451711a4ac3784ebacab5037e998fd3a24793586776dc7db
                                                                                                                                                                • Instruction ID: 0eb2667ef0ba2ff6b77c3bf4916909bf23b58f666c6e3c4ab508a9d160431c75
                                                                                                                                                                • Opcode Fuzzy Hash: 53c063ff91e1417e451711a4ac3784ebacab5037e998fd3a24793586776dc7db
                                                                                                                                                                • Instruction Fuzzy Hash: F7C1D3B4E04245AFDF15DFA8DC80BEDBBB6AF49300F044169E515AB3A2C7359982CB64
                                                                                                                                                                Function 0066C600 Relevance: 13.7, APIs: 9, Instructions: 240COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • std::locale::_Init.LIBCPMT ref: 0066C641
                                                                                                                                                                  • Part of subcall function 00683084: __EH_prolog3.LIBCMT ref: 0068308B
                                                                                                                                                                  • Part of subcall function 00683084: std::_Lockit::_Lockit.LIBCPMT ref: 00683096
                                                                                                                                                                  • Part of subcall function 00683084: std::locale::_Setgloballocale.LIBCPMT ref: 006830B1
                                                                                                                                                                  • Part of subcall function 00683084: std::_Lockit::~_Lockit.LIBCPMT ref: 00683107
                                                                                                                                                                • std::_Lockit::_Lockit.LIBCPMT ref: 0066C6CB
                                                                                                                                                                • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0066C713
                                                                                                                                                                • std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0066C748
                                                                                                                                                                • std::_Lockit::~_Lockit.LIBCPMT ref: 0066C7DD
                                                                                                                                                                  • Part of subcall function 0069E960: _free.LIBCMT ref: 0069E973
                                                                                                                                                                • std::locale::_Locimp::_New_Locimp.LIBCPMT ref: 0066C807
                                                                                                                                                                • std::_Lockit::_Lockit.LIBCPMT ref: 0066C82B
                                                                                                                                                                • std::_Lockit::~_Lockit.LIBCPMT ref: 0066C84C
                                                                                                                                                                • std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 0066C85B
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$Lockit$std::locale::_$Lockit::_Lockit::~_$Locimp::_Locinfo::_$AddfacH_prolog3InitLocimpLocimp_Locinfo_ctorLocinfo_dtorNew_Setgloballocale_free
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3142054045-0
                                                                                                                                                                • Opcode ID: 2ff2b5916531b0097f0557a9c078122d05de0105a071ed844b248e9b54a74310
                                                                                                                                                                • Instruction ID: 175f4671f8dc8dcae23676fdfbce022529f04ba648a262ed201684a210a3a5e8
                                                                                                                                                                • Opcode Fuzzy Hash: 2ff2b5916531b0097f0557a9c078122d05de0105a071ed844b248e9b54a74310
                                                                                                                                                                • Instruction Fuzzy Hash: 65A19BB0D00748DFEB20DFA9C845BAEBBFAAF04714F14412DE445A7781EB75AA04CB95
                                                                                                                                                                Function 0066E760 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 191encryptionCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CertGetCertificateContextProperty.CRYPT32(?,00000003,00000000,00000000), ref: 0066E877
                                                                                                                                                                • CertGetCertificateContextProperty.CRYPT32(?,00000003,00000000,00000014), ref: 0066E8A9
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CertCertificateContextProperty
                                                                                                                                                                • String ID: 1.2.840.10045.4.1$1.2.840.10045.4.3$1.2.840.10045.4.3.2$1.2.840.10045.4.3.3$1.2.840.10045.4.3.4
                                                                                                                                                                • API String ID: 665277682-3196566809
                                                                                                                                                                • Opcode ID: cd70ff6529dfd8da28a1c01999a5f3cee55feb9d4d380d4650ac219aa8f3b7da
                                                                                                                                                                • Instruction ID: 725cb98762991206687cd20788e1a5035fcfac53b8c00b7345e52d522cd902d0
                                                                                                                                                                • Opcode Fuzzy Hash: cd70ff6529dfd8da28a1c01999a5f3cee55feb9d4d380d4650ac219aa8f3b7da
                                                                                                                                                                • Instruction Fuzzy Hash: A0512839A002059FCF60DF69D891BEAB7A7AF11320F1442ADDC1A9B392D732ED10C790
                                                                                                                                                                Function 0064E2C0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 168COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID: z
                                                                                                                                                                • API String ID: 0-1657960367
                                                                                                                                                                • Opcode ID: c0fa20e573514b0c2c94aa1bdf24de11d9e503692d048af56095f5315f7537ff
                                                                                                                                                                • Instruction ID: f9f9e4367330435b27417dfc2b40d7e9b2d1364ca05bfb2c377e7945bc0dbc34
                                                                                                                                                                • Opcode Fuzzy Hash: c0fa20e573514b0c2c94aa1bdf24de11d9e503692d048af56095f5315f7537ff
                                                                                                                                                                • Instruction Fuzzy Hash: 79516271E012099BEB11DB94DC45FEEB7BAFB44324F10417AE905A7380E7769905CBA4
                                                                                                                                                                Function 00637107 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 163COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00637D3D
                                                                                                                                                                • __Mtx_unlock.LIBCPMT ref: 00637DC8
                                                                                                                                                                  • Part of subcall function 00629BB0: InitOnceBeginInitialize.KERNEL32(007180C4,00000000,D8276B9A,00000000,D8276B9A,0062A219,007180CC,?,?,?,?,?,?,0062A219,?,?), ref: 00629BE5
                                                                                                                                                                  • Part of subcall function 00629BB0: InitOnceComplete.KERNEL32(007180C4,00000000,00000000), ref: 00629C1D
                                                                                                                                                                  • Part of subcall function 00629940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00629A12
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 00637DFC
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00637EBB
                                                                                                                                                                  • Part of subcall function 00644B40: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0064521E
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Ios_base_dtorstd::ios_base::_$InitOnce$BeginCompleteConcurrency::cancel_current_taskInitializeMtx_unlock
                                                                                                                                                                • String ID: Failed to add event category ($Service has not been initialized$V
                                                                                                                                                                • API String ID: 342047005-375236208
                                                                                                                                                                • Opcode ID: 7801dffec4d62794ffdc2cbce2b97484f00a2ff5cab70a146cdd6708a219b370
                                                                                                                                                                • Instruction ID: 12ec21887af46805f57ef7f14ce50e11d829ee2c7bde51d40dcdd87743a232d8
                                                                                                                                                                • Opcode Fuzzy Hash: 7801dffec4d62794ffdc2cbce2b97484f00a2ff5cab70a146cdd6708a219b370
                                                                                                                                                                • Instruction Fuzzy Hash: BC51D0B1904248CFDB54EF60D856BEE7BB6FF14310F4041ADE8069B281EB759A08CFA5
                                                                                                                                                                Function 0063A6B6 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 135COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,D8276B9A,?,?), ref: 0063A531
                                                                                                                                                                • __Mtx_unlock.LIBCPMT ref: 0063A73D
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0063A7AC
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0063A989
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Ios_base_dtorstd::ios_base::_$Mtx_unlockMultipleObjectsWait
                                                                                                                                                                • String ID: Event string is empty$Unexpected return value: $`o
                                                                                                                                                                • API String ID: 1703231451-1620135602
                                                                                                                                                                • Opcode ID: 7276cd843495b5d3de00bea26abc98f777885a739613998531c00b08226fe27b
                                                                                                                                                                • Instruction ID: 641c87060034b7a5929c2c3f488f1997e4af97adf09235756388736740abdfb9
                                                                                                                                                                • Opcode Fuzzy Hash: 7276cd843495b5d3de00bea26abc98f777885a739613998531c00b08226fe27b
                                                                                                                                                                • Instruction Fuzzy Hash: F351F3709002189BDF18EFA4DC99BEDBB37AF51310F10429CE5955B2C2CB709A85DFA6
                                                                                                                                                                Function 00688203 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 49COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __EH_prolog3.LIBCMT ref: 0068820A
                                                                                                                                                                • std::_Lockit::_Lockit.LIBCPMT ref: 00688214
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::_Lockit.LIBCPMT ref: 00622D30
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00622D4C
                                                                                                                                                                • moneypunct.LIBCPMT ref: 0068824E
                                                                                                                                                                • std::_Facet_Register.LIBCPMT ref: 00688265
                                                                                                                                                                • std::_Lockit::~_Lockit.LIBCPMT ref: 00688285
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 00688292
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registermoneypunct
                                                                                                                                                                • String ID: `sq
                                                                                                                                                                • API String ID: 3376033448-2491840941
                                                                                                                                                                • Opcode ID: 5f095fcf12db8e990759a95e2dc8d78f24049928bf34694a69da9eb4e71bb751
                                                                                                                                                                • Instruction ID: 231ba99bba7a2a9ca114142dbe80474969508c724025dadc26240e04cb3792f5
                                                                                                                                                                • Opcode Fuzzy Hash: 5f095fcf12db8e990759a95e2dc8d78f24049928bf34694a69da9eb4e71bb751
                                                                                                                                                                • Instruction Fuzzy Hash: EE018B3190056A9FCB44BBA89851ABDB777BF80710F64460DE8206B381DF749B04DB98
                                                                                                                                                                Function 00688298 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 49COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __EH_prolog3.LIBCMT ref: 0068829F
                                                                                                                                                                • std::_Lockit::_Lockit.LIBCPMT ref: 006882A9
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::_Lockit.LIBCPMT ref: 00622D30
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00622D4C
                                                                                                                                                                • moneypunct.LIBCPMT ref: 006882E3
                                                                                                                                                                • std::_Facet_Register.LIBCPMT ref: 006882FA
                                                                                                                                                                • std::_Lockit::~_Lockit.LIBCPMT ref: 0068831A
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 00688327
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registermoneypunct
                                                                                                                                                                • String ID: \sq
                                                                                                                                                                • API String ID: 3376033448-3119998297
                                                                                                                                                                • Opcode ID: 521b33496d2cec753794ed0f3ed8410e44963cc48143bfd66a3b2a58ce2126ef
                                                                                                                                                                • Instruction ID: 993407c240d91ffba626cd5f7819d6dd78b02fa525760be534a8e7c3d5b2319f
                                                                                                                                                                • Opcode Fuzzy Hash: 521b33496d2cec753794ed0f3ed8410e44963cc48143bfd66a3b2a58ce2126ef
                                                                                                                                                                • Instruction Fuzzy Hash: 1501AD3590016A9FCB04BBA4D841ABEB7B7AF44B10F64460DE810AB3D1CF349E05DB98
                                                                                                                                                                Function 0068832D Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __EH_prolog3.LIBCMT ref: 00688334
                                                                                                                                                                • std::_Lockit::_Lockit.LIBCPMT ref: 0068833E
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::_Lockit.LIBCPMT ref: 00622D30
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00622D4C
                                                                                                                                                                • moneypunct.LIBCPMT ref: 00688378
                                                                                                                                                                • std::_Facet_Register.LIBCPMT ref: 0068838F
                                                                                                                                                                • std::_Lockit::~_Lockit.LIBCPMT ref: 006883AF
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 006883BC
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registermoneypunct
                                                                                                                                                                • String ID: 8sq
                                                                                                                                                                • API String ID: 3376033448-4129883813
                                                                                                                                                                • Opcode ID: 8a011ca2ed7825c66c0fe7e594f60ac3dc0acc91857c281b474ec92caa6bac72
                                                                                                                                                                • Instruction ID: ed5dba163cd44deb784206b3724e92fc19b785de0157fe63f5ea75b00968f28c
                                                                                                                                                                • Opcode Fuzzy Hash: 8a011ca2ed7825c66c0fe7e594f60ac3dc0acc91857c281b474ec92caa6bac72
                                                                                                                                                                • Instruction Fuzzy Hash: E901C0719005269FCB05FBA8D802ABE77B7AF40B10F64460DE810AB3D1DF749E05DB98
                                                                                                                                                                Function 006883C2 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __EH_prolog3.LIBCMT ref: 006883C9
                                                                                                                                                                • std::_Lockit::_Lockit.LIBCPMT ref: 006883D3
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::_Lockit.LIBCPMT ref: 00622D30
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00622D4C
                                                                                                                                                                • moneypunct.LIBCPMT ref: 0068840D
                                                                                                                                                                • std::_Facet_Register.LIBCPMT ref: 00688424
                                                                                                                                                                • std::_Lockit::~_Lockit.LIBCPMT ref: 00688444
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 00688451
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registermoneypunct
                                                                                                                                                                • String ID: 4sq
                                                                                                                                                                • API String ID: 3376033448-4281597889
                                                                                                                                                                • Opcode ID: 0d2475cda3e307db869097a6e7b33c9637ebe50d48583ca2a46ac17af1ce404d
                                                                                                                                                                • Instruction ID: cc2c9115e0358065651d21b4eeb0f3ec525e5d909307a0f3d785c6c230d40938
                                                                                                                                                                • Opcode Fuzzy Hash: 0d2475cda3e307db869097a6e7b33c9637ebe50d48583ca2a46ac17af1ce404d
                                                                                                                                                                • Instruction Fuzzy Hash: 35018B329002269BCB58BB64D841ABEB7B7BF80710F64460DE821AB381DF349A059B95
                                                                                                                                                                Function 00688616 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 49COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __EH_prolog3.LIBCMT ref: 0068861D
                                                                                                                                                                • std::_Lockit::_Lockit.LIBCPMT ref: 00688627
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::_Lockit.LIBCPMT ref: 00622D30
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00622D4C
                                                                                                                                                                • numpunct.LIBCPMT ref: 00688661
                                                                                                                                                                • std::_Facet_Register.LIBCPMT ref: 00688678
                                                                                                                                                                • std::_Lockit::~_Lockit.LIBCPMT ref: 00688698
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 006886A5
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registernumpunct
                                                                                                                                                                • String ID: Hsq
                                                                                                                                                                • API String ID: 3064348918-2732093173
                                                                                                                                                                • Opcode ID: 3573af32bf1bca679201a4b080d649a975e86a8dbc47ac7f75a0e6497a606f81
                                                                                                                                                                • Instruction ID: 570eed60a822ad6f107e413c980ebed6215074ea300f9ed5a59f877d5b3781ea
                                                                                                                                                                • Opcode Fuzzy Hash: 3573af32bf1bca679201a4b080d649a975e86a8dbc47ac7f75a0e6497a606f81
                                                                                                                                                                • Instruction Fuzzy Hash: 2301C0719002269FCB08FBA8D845AFD7777AF80714F64460DE4246B3C1EF349A45DB98
                                                                                                                                                                Function 006BA764 Relevance: 12.2, APIs: 8, Instructions: 203COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _free$___from_strstr_to_strchr
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3409252457-0
                                                                                                                                                                • Opcode ID: 9cbf85a008c0407f432689b9bc9d2d8718d43a881e048ac396e9b51702c542ec
                                                                                                                                                                • Instruction ID: b6c3eaf11ae5211c10c06c6792df93335afe2ac9c5dc609efa7f93b8f860f96b
                                                                                                                                                                • Opcode Fuzzy Hash: 9cbf85a008c0407f432689b9bc9d2d8718d43a881e048ac396e9b51702c542ec
                                                                                                                                                                • Instruction Fuzzy Hash: C35108F0908305AFDB24BFF88841AED77BAAF01350F01816DE5519B382EB3589C1DB56
                                                                                                                                                                Function 00648690 Relevance: 12.2, APIs: 8, Instructions: 172COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 0069987E: EnterCriticalSection.KERNEL32(007177A0,?,00000101,?,006486A7,00000000,?,00000101,?,00000000,?,?,0064C338,-00000010), ref: 00699889
                                                                                                                                                                  • Part of subcall function 0069987E: LeaveCriticalSection.KERNEL32(007177A0,?,006486A7,00000000,?,00000101,?,00000000,?,?,0064C338,-00000010,?,?,?,D8276B9A), ref: 006998B5
                                                                                                                                                                • FindResourceExW.KERNEL32(00000000,00000006,?,00000000,00000000), ref: 006486D6
                                                                                                                                                                • LoadResource.KERNEL32(00000000,00000000), ref: 006486E4
                                                                                                                                                                • LockResource.KERNEL32(00000000), ref: 006486EF
                                                                                                                                                                • SizeofResource.KERNEL32(00000000,00000000), ref: 006486FD
                                                                                                                                                                • FindResourceW.KERNEL32(00000000,?,00000006), ref: 00648764
                                                                                                                                                                • LoadResource.KERNEL32(00000000,00000000), ref: 00648776
                                                                                                                                                                • LockResource.KERNEL32(00000000), ref: 00648785
                                                                                                                                                                • SizeofResource.KERNEL32(00000000,00000000), ref: 00648797
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Resource$CriticalFindLoadLockSectionSizeof$EnterLeave
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 506522749-0
                                                                                                                                                                • Opcode ID: af49e5a0acd850ff8b423e4075a7e416f1566bac4900438718f0fd5749daf4e0
                                                                                                                                                                • Instruction ID: 84581456667dbb0c0bbc12e07d1d0c285fb37349cee08a36ab85e79f6eff402b
                                                                                                                                                                • Opcode Fuzzy Hash: af49e5a0acd850ff8b423e4075a7e416f1566bac4900438718f0fd5749daf4e0
                                                                                                                                                                • Instruction Fuzzy Hash: D2410631A002119FC720AF289894ABFB7EAEF94741F10092EFD5597341EF39DC55C6A5
                                                                                                                                                                Function 006B087D Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 264COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 006B1CA9: GetLastError.KERNEL32(00000008,00000016,00000000,006B4E01), ref: 006B1CAE
                                                                                                                                                                  • Part of subcall function 006B1CA9: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 006B1D4C
                                                                                                                                                                • _free.LIBCMT ref: 006B0B8A
                                                                                                                                                                • _free.LIBCMT ref: 006B0BA3
                                                                                                                                                                • _free.LIBCMT ref: 006B0BE1
                                                                                                                                                                • _free.LIBCMT ref: 006B0BEA
                                                                                                                                                                • _free.LIBCMT ref: 006B0BF6
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _free$ErrorLast
                                                                                                                                                                • String ID: C
                                                                                                                                                                • API String ID: 3291180501-1037565863
                                                                                                                                                                • Opcode ID: 5cf09c7ff85ca39e77d9f41d2734577e78ae3b67e1b611643ed1670ae1a4288d
                                                                                                                                                                • Instruction ID: 236baf793a4d1862ce560d726ece3aac3d42a12782f7b526267f92c2f2634903
                                                                                                                                                                • Opcode Fuzzy Hash: 5cf09c7ff85ca39e77d9f41d2734577e78ae3b67e1b611643ed1670ae1a4288d
                                                                                                                                                                • Instruction Fuzzy Hash: B2B109B590121A9BEB24DF18C894AEEB7B5FB18304F5045EEE949A7351D731AED0CF40
                                                                                                                                                                Function 00641230 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 202COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • InitOnceBeginInitialize.KERNEL32(0071823C,00000000,?,00000000,?,?,?,?,00000000,00000000,?,D8276B9A,?,?), ref: 0064125A
                                                                                                                                                                • InitOnceComplete.KERNEL32(0071823C,00000000,00000000), ref: 00641278
                                                                                                                                                                Strings
                                                                                                                                                                • [%S:(%d)][%S] Failed to create HMAC traits., xrefs: 006412F8
                                                                                                                                                                • [%S:(%d)][%S] Error trying to BCryptOpenAlgorithmProvider: %ls, xrefs: 006413E3
                                                                                                                                                                • McCryptoLib::CMcCryptoHMACWin::Initialize, xrefs: 006412EC, 006413D7
                                                                                                                                                                • C:\non_system\Code\McCryptoLib\src\windows\win_hmac.cpp, xrefs: 006412F3, 006413DE
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: InitOnce$BeginCompleteInitialize
                                                                                                                                                                • String ID: C:\non_system\Code\McCryptoLib\src\windows\win_hmac.cpp$McCryptoLib::CMcCryptoHMACWin::Initialize$[%S:(%d)][%S] Error trying to BCryptOpenAlgorithmProvider: %ls$[%S:(%d)][%S] Failed to create HMAC traits.
                                                                                                                                                                • API String ID: 51270584-3897904871
                                                                                                                                                                • Opcode ID: 5c85fd79105b54aa9d43a4b57710582a632aad63fc254d2a62de98e3c9391fd0
                                                                                                                                                                • Instruction ID: 4b05e848d2177d8f8b6b8068c22f39de74c6ae06de7c5a11f517e2538b1d7fbc
                                                                                                                                                                • Opcode Fuzzy Hash: 5c85fd79105b54aa9d43a4b57710582a632aad63fc254d2a62de98e3c9391fd0
                                                                                                                                                                • Instruction Fuzzy Hash: 1851BE717403069BDB10EF68DC42BAF77A6BF99700F00452DFA09DB291DA71E944CB96
                                                                                                                                                                Function 006452D0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 173COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID: 0.0.0.0$UUID$UUID$Version$kernel32.dll
                                                                                                                                                                • API String ID: 0-1483847951
                                                                                                                                                                • Opcode ID: 620d536e165b3f826fa2d613389c3f1e7e618b37c40d1692ad18bcf11ab79e17
                                                                                                                                                                • Instruction ID: 1ba83c65fe7d49616c35d9152f90e317dea59acabf77ea4ef6442bf7fb9277ab
                                                                                                                                                                • Opcode Fuzzy Hash: 620d536e165b3f826fa2d613389c3f1e7e618b37c40d1692ad18bcf11ab79e17
                                                                                                                                                                • Instruction Fuzzy Hash: 98819870904788CFEB24CFA8C9487EDBFB2AF45304F20825DD425AB792D7B94984CB51
                                                                                                                                                                Function 0064C960 Relevance: 10.6, APIs: 7, Instructions: 116COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • std::_Lockit::_Lockit.LIBCPMT ref: 0064C995
                                                                                                                                                                • std::_Lockit::_Lockit.LIBCPMT ref: 0064C9B7
                                                                                                                                                                • std::_Lockit::~_Lockit.LIBCPMT ref: 0064C9D7
                                                                                                                                                                • __Getctype.LIBCPMT ref: 0064CA70
                                                                                                                                                                • std::_Locinfo::~_Locinfo.LIBCPMT ref: 0064CA82
                                                                                                                                                                • std::_Facet_Register.LIBCPMT ref: 0064CA8F
                                                                                                                                                                • std::_Lockit::~_Lockit.LIBCPMT ref: 0064CAB1
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeLocinfoLocinfo::~_Register
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3947131827-0
                                                                                                                                                                • Opcode ID: af73764fca8fc835a461796c6815dfbe94128468bd44039c49dd4bb30d5921e1
                                                                                                                                                                • Instruction ID: bb7f0bff0f22737a50c10dc52bc1dcb77b1b5723a938edaf30c6537fb9771408
                                                                                                                                                                • Opcode Fuzzy Hash: af73764fca8fc835a461796c6815dfbe94128468bd44039c49dd4bb30d5921e1
                                                                                                                                                                • Instruction Fuzzy Hash: 5C410371901258DFCB51EF58D841AEEB7B6FF40720F10825DE409AB391EB34AE42CB85
                                                                                                                                                                Function 0063A550 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00629BB0: InitOnceBeginInitialize.KERNEL32(007180C4,00000000,D8276B9A,00000000,D8276B9A,0062A219,007180CC,?,?,?,?,?,?,0062A219,?,?), ref: 00629BE5
                                                                                                                                                                  • Part of subcall function 00629BB0: InitOnceComplete.KERNEL32(007180C4,00000000,00000000), ref: 00629C1D
                                                                                                                                                                  • Part of subcall function 00629940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00629A12
                                                                                                                                                                • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,D8276B9A,?,?), ref: 0063A531
                                                                                                                                                                • __Mtx_unlock.LIBCPMT ref: 0063A58B
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0063A989
                                                                                                                                                                • __Mtx_unlock.LIBCPMT ref: 0063A99D
                                                                                                                                                                Strings
                                                                                                                                                                • Unexpected return value: , xrefs: 0063A8CC
                                                                                                                                                                • Thread signalled when event queue is empty, xrefs: 0063A614
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: InitIos_base_dtorMtx_unlockOncestd::ios_base::_$BeginCompleteInitializeMultipleObjectsWait
                                                                                                                                                                • String ID: Thread signalled when event queue is empty$Unexpected return value:
                                                                                                                                                                • API String ID: 3324347728-3645029203
                                                                                                                                                                • Opcode ID: 039cfe3b3bbae26e3d64b9798a21354d1a033408eaf018bdc0bdd2ea6b2c66c9
                                                                                                                                                                • Instruction ID: 41018a38f3a7b6fc8693f84816d38d930420012a944174f7fa10fa913e4add0b
                                                                                                                                                                • Opcode Fuzzy Hash: 039cfe3b3bbae26e3d64b9798a21354d1a033408eaf018bdc0bdd2ea6b2c66c9
                                                                                                                                                                • Instruction Fuzzy Hash: 6941DCB0D012289ADB54EFE0DC49BDDBB7BAF11314F10429CE4456A2C1DB746B89CF96
                                                                                                                                                                Function 006B416A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID: api-ms-$ext-ms-
                                                                                                                                                                • API String ID: 0-537541572
                                                                                                                                                                • Opcode ID: 679aaa40de3142e0ff68ee610c183b6103a702891d40ebbcd472a93d6bfae2d7
                                                                                                                                                                • Instruction ID: 99621f668406c3ab7cd489296326f1bfe637e9859ef7c96a7eca2208106fe9e3
                                                                                                                                                                • Opcode Fuzzy Hash: 679aaa40de3142e0ff68ee610c183b6103a702891d40ebbcd472a93d6bfae2d7
                                                                                                                                                                • Instruction Fuzzy Hash: 3321D5F1E42221ABDB219B68DC80AEA37AA9F11760F110111FD15AB3D2DE71DD82D7E0
                                                                                                                                                                Function 00688044 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __EH_prolog3.LIBCMT ref: 0068804B
                                                                                                                                                                • std::_Lockit::_Lockit.LIBCPMT ref: 00688055
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::_Lockit.LIBCPMT ref: 00622D30
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00622D4C
                                                                                                                                                                • std::_Facet_Register.LIBCPMT ref: 006880A6
                                                                                                                                                                • std::_Lockit::~_Lockit.LIBCPMT ref: 006880C6
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 006880D3
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
                                                                                                                                                                • String ID: ,sq
                                                                                                                                                                • API String ID: 55977855-3976596745
                                                                                                                                                                • Opcode ID: ceb19afde96baf0e74162869064405bc043d0c7b58d067c8b463baba816c0569
                                                                                                                                                                • Instruction ID: 9ab6e158a8014a262a4d6820256c1aea114cd068897d63c4c333b4fa330191ed
                                                                                                                                                                • Opcode Fuzzy Hash: ceb19afde96baf0e74162869064405bc043d0c7b58d067c8b463baba816c0569
                                                                                                                                                                • Instruction Fuzzy Hash: 7901AD3190022A9FCB05BB64D841ABE7777AF44710F65060DE4106B3C1DF759A09DB94
                                                                                                                                                                Function 006880D9 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __EH_prolog3.LIBCMT ref: 006880E0
                                                                                                                                                                • std::_Lockit::_Lockit.LIBCPMT ref: 006880EA
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::_Lockit.LIBCPMT ref: 00622D30
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00622D4C
                                                                                                                                                                • std::_Facet_Register.LIBCPMT ref: 0068813B
                                                                                                                                                                • std::_Lockit::~_Lockit.LIBCPMT ref: 0068815B
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 00688168
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
                                                                                                                                                                • String ID: Xsq
                                                                                                                                                                • API String ID: 55977855-3204369797
                                                                                                                                                                • Opcode ID: 5b41cc718c0c9c5b321f25cec40734f17e61e172e03a500f2865621c36e308f0
                                                                                                                                                                • Instruction ID: bfc199f95131d11adb4952f5f00e2c1d1c0b9e03e430e09a07436297d892912f
                                                                                                                                                                • Opcode Fuzzy Hash: 5b41cc718c0c9c5b321f25cec40734f17e61e172e03a500f2865621c36e308f0
                                                                                                                                                                • Instruction Fuzzy Hash: 4701AD3190026A9FCB05FB64D846AFE7777AF84B10F64060DE420AB3C1DF349A05DB98
                                                                                                                                                                Function 0068816E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __EH_prolog3.LIBCMT ref: 00688175
                                                                                                                                                                • std::_Lockit::_Lockit.LIBCPMT ref: 0068817F
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::_Lockit.LIBCPMT ref: 00622D30
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00622D4C
                                                                                                                                                                • std::_Facet_Register.LIBCPMT ref: 006881D0
                                                                                                                                                                • std::_Lockit::~_Lockit.LIBCPMT ref: 006881F0
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 006881FD
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
                                                                                                                                                                • String ID: 0sq
                                                                                                                                                                • API String ID: 55977855-4164572957
                                                                                                                                                                • Opcode ID: 8bfd5aeeac567fb8d127888d93aaf0fed1f0ec9fa31017279394226da02e93ca
                                                                                                                                                                • Instruction ID: 97f32fa70ca81a5622a63e8ee93182105b4a09e1a64fbca1ff3bfffa972b7b44
                                                                                                                                                                • Opcode Fuzzy Hash: 8bfd5aeeac567fb8d127888d93aaf0fed1f0ec9fa31017279394226da02e93ca
                                                                                                                                                                • Instruction Fuzzy Hash: EF01AD319001669FCB04BB68D845ABDB7B7BF44710F64460DE820AB3D1DF749E05DB98
                                                                                                                                                                Function 00688457 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __EH_prolog3.LIBCMT ref: 0068845E
                                                                                                                                                                • std::_Lockit::_Lockit.LIBCPMT ref: 00688468
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::_Lockit.LIBCPMT ref: 00622D30
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00622D4C
                                                                                                                                                                • std::_Facet_Register.LIBCPMT ref: 006884B9
                                                                                                                                                                • std::_Lockit::~_Lockit.LIBCPMT ref: 006884D9
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 006884E6
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
                                                                                                                                                                • String ID: @sq
                                                                                                                                                                • API String ID: 55977855-2899001165
                                                                                                                                                                • Opcode ID: 8ac6d2254e3d7cc21bf886fb3390cf654f1e6cb7f2d22675f831ce4d81d4ffb6
                                                                                                                                                                • Instruction ID: 0d527bd5e64132ade4b60db202687bf597f4bb41273f2451499dc4844646f124
                                                                                                                                                                • Opcode Fuzzy Hash: 8ac6d2254e3d7cc21bf886fb3390cf654f1e6cb7f2d22675f831ce4d81d4ffb6
                                                                                                                                                                • Instruction Fuzzy Hash: A8018B3290012A9FCB05FB649841ABEB7B7BF80710F64460DF4206B391DF34AA05DB94
                                                                                                                                                                Function 006884EC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __EH_prolog3.LIBCMT ref: 006884F3
                                                                                                                                                                • std::_Lockit::_Lockit.LIBCPMT ref: 006884FD
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::_Lockit.LIBCPMT ref: 00622D30
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00622D4C
                                                                                                                                                                • std::_Facet_Register.LIBCPMT ref: 0068854E
                                                                                                                                                                • std::_Lockit::~_Lockit.LIBCPMT ref: 0068856E
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 0068857B
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
                                                                                                                                                                • String ID: sq
                                                                                                                                                                • API String ID: 55977855-3827102829
                                                                                                                                                                • Opcode ID: 854d4d0a41004b26577a5c8f9db599d2d9b12d7c38556f901b26a29bca266322
                                                                                                                                                                • Instruction ID: fedb26729a7dd6c892750efa5ec11665e7f6c664285408d0b1b30863c00399a6
                                                                                                                                                                • Opcode Fuzzy Hash: 854d4d0a41004b26577a5c8f9db599d2d9b12d7c38556f901b26a29bca266322
                                                                                                                                                                • Instruction Fuzzy Hash: 9D01AD319005269FCB44FB64D841ABEB7B7BF40710F64860DE820AB3D1DF349A05DB9A
                                                                                                                                                                Function 00688581 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __EH_prolog3.LIBCMT ref: 00688588
                                                                                                                                                                • std::_Lockit::_Lockit.LIBCPMT ref: 00688592
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::_Lockit.LIBCPMT ref: 00622D30
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00622D4C
                                                                                                                                                                • std::_Facet_Register.LIBCPMT ref: 006885E3
                                                                                                                                                                • std::_Lockit::~_Lockit.LIBCPMT ref: 00688603
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 00688610
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
                                                                                                                                                                • String ID: Dsq
                                                                                                                                                                • API String ID: 55977855-2881656721
                                                                                                                                                                • Opcode ID: 269571d9352647e20552e7b76f24802424d1447937a50db367e7761b7e39e311
                                                                                                                                                                • Instruction ID: 8b0da4841b979278a9ac995df0ab797bf6b415e7bd0f5b09867ac266367ad66d
                                                                                                                                                                • Opcode Fuzzy Hash: 269571d9352647e20552e7b76f24802424d1447937a50db367e7761b7e39e311
                                                                                                                                                                • Instruction Fuzzy Hash: BC01AD319001269FCB44BB64D841ABE7777BF80710F64060DE4106B3C1DF349A05DB99
                                                                                                                                                                Function 006886AB Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __EH_prolog3.LIBCMT ref: 006886B2
                                                                                                                                                                • std::_Lockit::_Lockit.LIBCPMT ref: 006886BC
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::_Lockit.LIBCPMT ref: 00622D30
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00622D4C
                                                                                                                                                                • std::_Facet_Register.LIBCPMT ref: 0068870D
                                                                                                                                                                • std::_Lockit::~_Lockit.LIBCPMT ref: 0068872D
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 0068873A
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
                                                                                                                                                                • String ID: dsq
                                                                                                                                                                • API String ID: 55977855-2475676017
                                                                                                                                                                • Opcode ID: 0963c873276eb262093b30674d493d66c3f38c5fb3f3e1d595e168616786db1e
                                                                                                                                                                • Instruction ID: 825d3325fb303587c3cbf353cabaad88600fc81918971ca99e1146843af24e42
                                                                                                                                                                • Opcode Fuzzy Hash: 0963c873276eb262093b30674d493d66c3f38c5fb3f3e1d595e168616786db1e
                                                                                                                                                                • Instruction Fuzzy Hash: 4401AD3190016A9FCB05FB64D951ABDB777BF44710F64460DE8116B3C1DF389A05DB98
                                                                                                                                                                Function 00688740 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __EH_prolog3.LIBCMT ref: 00688747
                                                                                                                                                                • std::_Lockit::_Lockit.LIBCPMT ref: 00688751
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::_Lockit.LIBCPMT ref: 00622D30
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00622D4C
                                                                                                                                                                • std::_Facet_Register.LIBCPMT ref: 006887A2
                                                                                                                                                                • std::_Lockit::~_Lockit.LIBCPMT ref: 006887C2
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 006887CF
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
                                                                                                                                                                • String ID: <sq
                                                                                                                                                                • API String ID: 55977855-4045450873
                                                                                                                                                                • Opcode ID: eddaba287f4e3bf88f5ffa7cf003fde92653a963a0129b818ea815d5c148caa2
                                                                                                                                                                • Instruction ID: 6f2bfd41c07f35b51d2d50b3ca2d30309787fc194fc8daa41ae7ce786f2c6e69
                                                                                                                                                                • Opcode Fuzzy Hash: eddaba287f4e3bf88f5ffa7cf003fde92653a963a0129b818ea815d5c148caa2
                                                                                                                                                                • Instruction Fuzzy Hash: 0601AD35900266AFCB04FB64D841ABE7777AF44B10F64060DE8106B3C1DF749E04DB98
                                                                                                                                                                Function 006887D5 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __EH_prolog3.LIBCMT ref: 006887DC
                                                                                                                                                                • std::_Lockit::_Lockit.LIBCPMT ref: 006887E6
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::_Lockit.LIBCPMT ref: 00622D30
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00622D4C
                                                                                                                                                                • std::_Facet_Register.LIBCPMT ref: 00688837
                                                                                                                                                                • std::_Lockit::~_Lockit.LIBCPMT ref: 00688857
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 00688864
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
                                                                                                                                                                • String ID: hsq
                                                                                                                                                                • API String ID: 55977855-2593466389
                                                                                                                                                                • Opcode ID: 4f71590d8c677ca201f4f60c65fd1770b88bd687ab0b581a8324cb83f1f444ed
                                                                                                                                                                • Instruction ID: d844bdbc1313b435b256a8a2bab32c438802a80048d0317d6a950468840ee765
                                                                                                                                                                • Opcode Fuzzy Hash: 4f71590d8c677ca201f4f60c65fd1770b88bd687ab0b581a8324cb83f1f444ed
                                                                                                                                                                • Instruction Fuzzy Hash: 9C018BB19002669FCB44FB64D841ABE7777BF44B10FA4460DE4106B381DF349A04DB94
                                                                                                                                                                Function 006988B0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • EnterCriticalSection.KERNEL32(0071742C,?,?,00634086,0071827C,006D68E0,?), ref: 006988BA
                                                                                                                                                                • LeaveCriticalSection.KERNEL32(0071742C,?,?,00634086,0071827C,006D68E0,?), ref: 006988ED
                                                                                                                                                                • RtlWakeAllConditionVariable.NTDLL ref: 00698964
                                                                                                                                                                • SetEvent.KERNEL32(?,00634086,0071827C,006D68E0,?), ref: 0069896E
                                                                                                                                                                • ResetEvent.KERNEL32(?,00634086,0071827C,006D68E0,?), ref: 0069897A
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CriticalEventSection$ConditionEnterLeaveResetVariableWake
                                                                                                                                                                • String ID: ,tq
                                                                                                                                                                • API String ID: 3916383385-2722601934
                                                                                                                                                                • Opcode ID: 2203d356a489f73ce5d8ced05bacbf9b037a7682ef6be6a8c0d093c07b110b3f
                                                                                                                                                                • Instruction ID: b718f8061d5febef5199cb7270428123018cad499fcbac9d3a338a68f17ee325
                                                                                                                                                                • Opcode Fuzzy Hash: 2203d356a489f73ce5d8ced05bacbf9b037a7682ef6be6a8c0d093c07b110b3f
                                                                                                                                                                • Instruction Fuzzy Hash: 50014671A05160DFCB18AF28FC488987BBAEB0E711701816AFC0297760CB3A1811CB98
                                                                                                                                                                Function 0069809D Relevance: 9.2, APIs: 6, Instructions: 224COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetCPInfo.KERNEL32(?,?), ref: 00698128
                                                                                                                                                                • MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 006981B6
                                                                                                                                                                • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00698228
                                                                                                                                                                • MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00698242
                                                                                                                                                                • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 006982A5
                                                                                                                                                                • CompareStringEx.KERNEL32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 006982C2
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ByteCharMultiWide$CompareInfoString
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2984826149-0
                                                                                                                                                                • Opcode ID: 6902c5e3d909c7b664e0273b36ddc018b284bb0ad29b2cf5b7cf2dd7e6993e19
                                                                                                                                                                • Instruction ID: c0da2ea27eb84cb1d5ef5eda3dcbeda9de8faf70a9aab0e0cc8151524b9c0d59
                                                                                                                                                                • Opcode Fuzzy Hash: 6902c5e3d909c7b664e0273b36ddc018b284bb0ad29b2cf5b7cf2dd7e6993e19
                                                                                                                                                                • Instruction Fuzzy Hash: 7571907290060AAEDF219FA4CC41AEF7BBFAF47314F24015AE845A7651DF35C905CBA4
                                                                                                                                                                Function 006868B8 Relevance: 9.2, APIs: 6, Instructions: 175COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 00686901
                                                                                                                                                                • MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 0068696C
                                                                                                                                                                • LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00686989
                                                                                                                                                                • LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 006869C8
                                                                                                                                                                • LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00686A27
                                                                                                                                                                • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00686A4A
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ByteCharMultiStringWide
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2829165498-0
                                                                                                                                                                • Opcode ID: 741a3a1f4c0932a1c0a160659e120378596934996d043fecb778eeadffc095f6
                                                                                                                                                                • Instruction ID: 7819bb89f7d6580d93662e41b7bd797d3c50600492396c87ed025fc20f1b5d61
                                                                                                                                                                • Opcode Fuzzy Hash: 741a3a1f4c0932a1c0a160659e120378596934996d043fecb778eeadffc095f6
                                                                                                                                                                • Instruction Fuzzy Hash: 2E51AF72900216AFEF24AF64CC45FEB7BABEF40750F148629F915AA290E731DD11CB60
                                                                                                                                                                Function 0062E790 Relevance: 9.1, APIs: 6, Instructions: 130COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000001,?,00000000), ref: 0062E7D7
                                                                                                                                                                • GetSecurityDescriptorDacl.ADVAPI32(00000000,00000000,00000000,?), ref: 0062E811
                                                                                                                                                                • SetNamedSecurityInfoW.ADVAPI32(00000000,00000001,00000004,00000000,00000000,00000000,00000000,?), ref: 0062E86D
                                                                                                                                                                • LocalFree.KERNEL32(00000000), ref: 0062E8C7
                                                                                                                                                                • LocalFree.KERNEL32(00000000), ref: 0062E8DC
                                                                                                                                                                • LocalFree.KERNEL32(00000000), ref: 0062E917
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Security$DescriptorFreeLocal$ConvertDaclInfoNamedString
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2792426717-0
                                                                                                                                                                • Opcode ID: 82fff1816cf6d347bafa1c055f365d282078acff2c137f230738fbcfa2616f3f
                                                                                                                                                                • Instruction ID: 6528920b185874529dd3fc6c58e741b25c19fa11dfef85ba51e54fe969f1e5bc
                                                                                                                                                                • Opcode Fuzzy Hash: 82fff1816cf6d347bafa1c055f365d282078acff2c137f230738fbcfa2616f3f
                                                                                                                                                                • Instruction Fuzzy Hash: F3415F71E01618ABEF10DFA4DD49BEEB7BAEF04704F20012AF901A6290D77A9944CF65
                                                                                                                                                                Function 00628D10 Relevance: 9.1, APIs: 6, Instructions: 128COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • std::_Lockit::_Lockit.LIBCPMT ref: 00628D46
                                                                                                                                                                • std::_Lockit::_Lockit.LIBCPMT ref: 00628D66
                                                                                                                                                                • std::_Lockit::~_Lockit.LIBCPMT ref: 00628D86
                                                                                                                                                                • std::_Locinfo::~_Locinfo.LIBCPMT ref: 00628E57
                                                                                                                                                                • std::_Facet_Register.LIBCPMT ref: 00628E64
                                                                                                                                                                • std::_Lockit::~_Lockit.LIBCPMT ref: 00628E86
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_LocinfoLocinfo::~_Register
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2966223926-0
                                                                                                                                                                • Opcode ID: 8b7a0db6d4bff83a65d4b6115ed8987552dc2814935d161c3a05308b084e638e
                                                                                                                                                                • Instruction ID: b2223665d9126f6fd9a201620df81e47d06c19071ec0ff8af61db344f602f3b1
                                                                                                                                                                • Opcode Fuzzy Hash: 8b7a0db6d4bff83a65d4b6115ed8987552dc2814935d161c3a05308b084e638e
                                                                                                                                                                • Instruction Fuzzy Hash: 0D41BC71900625CFCB51EF54E881BAEBBB6FF50710F15825DE406AB391DF35AA0ACB81
                                                                                                                                                                Function 006A3207 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 375COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: __freea
                                                                                                                                                                • String ID: 3Aj$a/p$am/pm
                                                                                                                                                                • API String ID: 240046367-3018077969
                                                                                                                                                                • Opcode ID: 89b035b2cf58a03cf683757877d4fda5812fcba3e298058da755af77230e03b4
                                                                                                                                                                • Instruction ID: 96a549bb442904c463100c8006b6fdeed1ff708d6a35dcc8d0168ad3a038eb36
                                                                                                                                                                • Opcode Fuzzy Hash: 89b035b2cf58a03cf683757877d4fda5812fcba3e298058da755af77230e03b4
                                                                                                                                                                • Instruction Fuzzy Hash: 61C1BC35D042269ACF24AFA8C995AFABBB2EF0B700F294149F501AB351D7359F42CF51
                                                                                                                                                                Function 00633400 Relevance: 9.1, APIs: 6, Instructions: 122COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • std::_Lockit::_Lockit.LIBCPMT ref: 00633435
                                                                                                                                                                • std::_Lockit::_Lockit.LIBCPMT ref: 00633457
                                                                                                                                                                • std::_Lockit::~_Lockit.LIBCPMT ref: 00633477
                                                                                                                                                                • std::_Locinfo::~_Locinfo.LIBCPMT ref: 0063353A
                                                                                                                                                                • std::_Facet_Register.LIBCPMT ref: 00633547
                                                                                                                                                                • std::_Lockit::~_Lockit.LIBCPMT ref: 00633569
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_LocinfoLocinfo::~_Register
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2966223926-0
                                                                                                                                                                • Opcode ID: 78c82c8bad2a71df555cf96fb8a388ef27d8084d9057b910106b7fa83f028ace
                                                                                                                                                                • Instruction ID: bd446c4f6b58ceb941fcb023c33f5376e92c2af5220d2e9542764ddfcd206b51
                                                                                                                                                                • Opcode Fuzzy Hash: 78c82c8bad2a71df555cf96fb8a388ef27d8084d9057b910106b7fa83f028ace
                                                                                                                                                                • Instruction Fuzzy Hash: F241DD719002659FCB01EF58D841AAEB7FAFF54710F14825DE805AB352EB34EA46CB91
                                                                                                                                                                Function 006232DE Relevance: 9.1, APIs: 6, Instructions: 70COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __EH_prolog3_GS.LIBCMT ref: 006232E5
                                                                                                                                                                • std::_Lockit::_Lockit.LIBCPMT ref: 006232F2
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::_Lockit.LIBCPMT ref: 00622D30
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00622D4C
                                                                                                                                                                • std::_Facet_Register.LIBCPMT ref: 00623340
                                                                                                                                                                • std::_Lockit::~_Lockit.LIBCPMT ref: 00623360
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 0062336D
                                                                                                                                                                • __Towlower.LIBCPMT ref: 00623388
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3_RegisterTowlower
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2111902878-0
                                                                                                                                                                • Opcode ID: 8a5becdd228492536d75035b5ae66cc33481fe03d42771be51d5dbe3cf60eb88
                                                                                                                                                                • Instruction ID: 76eb03c57fb8ec731a8374ec941291310ea9fa01300bb1c3be0fb0767d0cce65
                                                                                                                                                                • Opcode Fuzzy Hash: 8a5becdd228492536d75035b5ae66cc33481fe03d42771be51d5dbe3cf60eb88
                                                                                                                                                                • Instruction Fuzzy Hash: 1311063190052A9FCB44FB68E441ABD77A7AF84710F24010EF50567391DF349F018F99
                                                                                                                                                                Function 0068435B Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __EH_prolog3.LIBCMT ref: 00684362
                                                                                                                                                                • std::_Lockit::_Lockit.LIBCPMT ref: 0068436C
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::_Lockit.LIBCPMT ref: 00622D30
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00622D4C
                                                                                                                                                                • codecvt.LIBCPMT ref: 006843A6
                                                                                                                                                                • std::_Facet_Register.LIBCPMT ref: 006843BD
                                                                                                                                                                • std::_Lockit::~_Lockit.LIBCPMT ref: 006843DD
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 006843EA
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercodecvt
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2133458128-0
                                                                                                                                                                • Opcode ID: 2bd9fdcd1f61665e2abe35e8d1a611f40e01d5cd72c21b4f793f57867aafdda9
                                                                                                                                                                • Instruction ID: 13d4cf32f49d6ea3ca58a34a0854d98073046ff51cad3750c06b435790b5c6be
                                                                                                                                                                • Opcode Fuzzy Hash: 2bd9fdcd1f61665e2abe35e8d1a611f40e01d5cd72c21b4f793f57867aafdda9
                                                                                                                                                                • Instruction Fuzzy Hash: 5501C0319002269BCB04FB64D851ABD77B7BF54710F24460DE4146B3C1CF749E05CB84
                                                                                                                                                                Function 00694475 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __EH_prolog3.LIBCMT ref: 0069447C
                                                                                                                                                                • std::_Lockit::_Lockit.LIBCPMT ref: 00694486
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::_Lockit.LIBCPMT ref: 00622D30
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00622D4C
                                                                                                                                                                • collate.LIBCPMT ref: 006944C0
                                                                                                                                                                • std::_Facet_Register.LIBCPMT ref: 006944D7
                                                                                                                                                                • std::_Lockit::~_Lockit.LIBCPMT ref: 006944F7
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 00694504
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercollate
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1767075461-0
                                                                                                                                                                • Opcode ID: 34df15b52d2d99a6f6822078d1dcdc63800ee11b2deb7e7d1c664bc6b6301352
                                                                                                                                                                • Instruction ID: 342c34e3dc67e0c61e0ad0be84bf6b75b768223d2e5632d8f9c29d60a2f4539a
                                                                                                                                                                • Opcode Fuzzy Hash: 34df15b52d2d99a6f6822078d1dcdc63800ee11b2deb7e7d1c664bc6b6301352
                                                                                                                                                                • Instruction Fuzzy Hash: 9E01A1319001669BCF04FB64D851ABDB7BBBF44710F24450DE4106B7C1DF349A05DB84
                                                                                                                                                                Function 0069450A Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __EH_prolog3.LIBCMT ref: 00694511
                                                                                                                                                                • std::_Lockit::_Lockit.LIBCPMT ref: 0069451B
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::_Lockit.LIBCPMT ref: 00622D30
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00622D4C
                                                                                                                                                                • messages.LIBCPMT ref: 00694555
                                                                                                                                                                • std::_Facet_Register.LIBCPMT ref: 0069456C
                                                                                                                                                                • std::_Lockit::~_Lockit.LIBCPMT ref: 0069458C
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 00694599
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registermessages
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 958335874-0
                                                                                                                                                                • Opcode ID: 3bee21d3b915bbde3c222cd652e1841b9cce01fbd1596ee062e6b4ca401d30b3
                                                                                                                                                                • Instruction ID: 5f87b6ee64fd54df9d110cb613d786e7ddfa916f72830f3a44ba7cc476db0814
                                                                                                                                                                • Opcode Fuzzy Hash: 3bee21d3b915bbde3c222cd652e1841b9cce01fbd1596ee062e6b4ca401d30b3
                                                                                                                                                                • Instruction Fuzzy Hash: B201CB719001269BCF04EBA4D841ABE777BAF44710F25050EF4106B3C0DF349A01CB88
                                                                                                                                                                Function 006946C9 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __EH_prolog3.LIBCMT ref: 006946D0
                                                                                                                                                                • std::_Lockit::_Lockit.LIBCPMT ref: 006946DA
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::_Lockit.LIBCPMT ref: 00622D30
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00622D4C
                                                                                                                                                                • moneypunct.LIBCPMT ref: 00694714
                                                                                                                                                                • std::_Facet_Register.LIBCPMT ref: 0069472B
                                                                                                                                                                • std::_Lockit::~_Lockit.LIBCPMT ref: 0069474B
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 00694758
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registermoneypunct
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3376033448-0
                                                                                                                                                                • Opcode ID: d8a3550465c44c0ffd526440fa303d666ae6b90bbfacc1e06220940e43645e07
                                                                                                                                                                • Instruction ID: 5863e199adc3b011127ea2cbf6ed528ffd8e5efd16effe4277d676b739cddf7b
                                                                                                                                                                • Opcode Fuzzy Hash: d8a3550465c44c0ffd526440fa303d666ae6b90bbfacc1e06220940e43645e07
                                                                                                                                                                • Instruction Fuzzy Hash: BE01C03590016A9BCF08FBA4D841AFE77BBAF44710F25050DE820AB7D1CF749A06DB85
                                                                                                                                                                Function 0069475E Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __EH_prolog3.LIBCMT ref: 00694765
                                                                                                                                                                • std::_Lockit::_Lockit.LIBCPMT ref: 0069476F
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::_Lockit.LIBCPMT ref: 00622D30
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00622D4C
                                                                                                                                                                • moneypunct.LIBCPMT ref: 006947A9
                                                                                                                                                                • std::_Facet_Register.LIBCPMT ref: 006947C0
                                                                                                                                                                • std::_Lockit::~_Lockit.LIBCPMT ref: 006947E0
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 006947ED
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registermoneypunct
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3376033448-0
                                                                                                                                                                • Opcode ID: a903478ae3c297353f3b6d7124bc9a7cd56e0efe07eacac50e8de720aa235194
                                                                                                                                                                • Instruction ID: 3559467cb244e3a81605b77adf5150e0720f3116aeaddf2921bf21bd910aca46
                                                                                                                                                                • Opcode Fuzzy Hash: a903478ae3c297353f3b6d7124bc9a7cd56e0efe07eacac50e8de720aa235194
                                                                                                                                                                • Instruction Fuzzy Hash: 2A01AD3591012A9BCF04BBA8D841ABEB77BBF80724F24050DE4206B7D1CF749A05DB89
                                                                                                                                                                Function 0064C410 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 132COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 0064C546
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 0064C54B
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 0064C550
                                                                                                                                                                  • Part of subcall function 0069E960: _free.LIBCMT ref: 0069E973
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Concurrency::cancel_current_task$_free
                                                                                                                                                                • String ID: false$true
                                                                                                                                                                • API String ID: 149343396-2658103896
                                                                                                                                                                • Opcode ID: 5a46146b16f2aa8e24e38f6ba429976aaa89af667a5538907a7522b6df8b6723
                                                                                                                                                                • Instruction ID: dd8a17373bb51c0b052aeaec1fc825c966e45767906fc203fcb83c2111c70d3a
                                                                                                                                                                • Opcode Fuzzy Hash: 5a46146b16f2aa8e24e38f6ba429976aaa89af667a5538907a7522b6df8b6723
                                                                                                                                                                • Instruction Fuzzy Hash: 834175B19013419FCB60EF74D851BAABBF6EF06310F04855DE8469B742D776EA04CBA0
                                                                                                                                                                Function 0069D1B7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • FreeLibrary.KERNEL32(00000000,?,?,?,0069D278,?,?,007177FC,00000000,?,0069D3A3,00000004,InitializeCriticalSectionEx,006F013C,006F0144,00000000), ref: 0069D247
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FreeLibrary
                                                                                                                                                                • String ID: api-ms-
                                                                                                                                                                • API String ID: 3664257935-2084034818
                                                                                                                                                                • Opcode ID: 6bb4f41d2bc8bda42c16a6f5a620639ce753af92e1a4abf7477268555ac3e3cb
                                                                                                                                                                • Instruction ID: 2b08d3e3eef8225b63ea0341aa48ec48e3a360581235274e1e20f2efdb0fb694
                                                                                                                                                                • Opcode Fuzzy Hash: 6bb4f41d2bc8bda42c16a6f5a620639ce753af92e1a4abf7477268555ac3e3cb
                                                                                                                                                                • Instruction Fuzzy Hash: A6118632A41225ABDF229B689C45B9977AAAF41B60F150171FE01EB7C0D770EE01C6E1
                                                                                                                                                                Function 0064E150 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registrylibraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleHandleW.KERNEL32(Advapi32.dll), ref: 0064E172
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0064E182
                                                                                                                                                                • RegDeleteKeyW.ADVAPI32(00000000,?), ref: 0064E1C2
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressDeleteHandleModuleProc
                                                                                                                                                                • String ID: Advapi32.dll$RegDeleteKeyExW
                                                                                                                                                                • API String ID: 588496660-2191092095
                                                                                                                                                                • Opcode ID: 85efd355b957baff49e8aa4f8797a461b40f897c5f8b012a9e17b4fa54a7d0d5
                                                                                                                                                                • Instruction ID: ab8de46fce175abbd0b99b900e372e6458395b33f983a95f8da757377b67ffe0
                                                                                                                                                                • Opcode Fuzzy Hash: 85efd355b957baff49e8aa4f8797a461b40f897c5f8b012a9e17b4fa54a7d0d5
                                                                                                                                                                • Instruction Fuzzy Hash: 2001717A6843449AD3205B9AFC04BE27BAAB791B21F04C13BE104C76A0C7F79499DB64
                                                                                                                                                                Function 006711F0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 39fileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00671210
                                                                                                                                                                • GetLastError.KERNEL32 ref: 0067121A
                                                                                                                                                                Strings
                                                                                                                                                                • WriteFile failed: %d, xrefs: 00671221
                                                                                                                                                                • NWebAdvisor::CCabParser::Write, xrefs: 00671228
                                                                                                                                                                • c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\CabParser.h, xrefs: 0067122D
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorFileLastWrite
                                                                                                                                                                • String ID: NWebAdvisor::CCabParser::Write$WriteFile failed: %d$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\CabParser.h
                                                                                                                                                                • API String ID: 442123175-2264278858
                                                                                                                                                                • Opcode ID: 41044bec0057ffd0db794678b6ca5732d55a270f0d9d900ba6313ffcddbea569
                                                                                                                                                                • Instruction ID: 6293c6ea27f05b3565a63e8c30c1f269ae0fa0a19b5e2aa22f407689fda9d8a6
                                                                                                                                                                • Opcode Fuzzy Hash: 41044bec0057ffd0db794678b6ca5732d55a270f0d9d900ba6313ffcddbea569
                                                                                                                                                                • Instruction Fuzzy Hash: 64F0A431B40208BFDB40EFA4DC03F6DB7A6EF14B04F404159FD05AB181D9729A14D750
                                                                                                                                                                Function 006508A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 37libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleHandleW.KERNEL32(kernel32), ref: 006508A9
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 006508C0
                                                                                                                                                                • GetCurrentProcess.KERNEL32(?), ref: 006508D7
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressCurrentHandleModuleProcProcess
                                                                                                                                                                • String ID: IsWow64Process$kernel32
                                                                                                                                                                • API String ID: 4190356694-3789238822
                                                                                                                                                                • Opcode ID: e7bea6223b25fbbd7afafe02aba2063f7c18d536b268d7b1cb49c2df5d7d5825
                                                                                                                                                                • Instruction ID: 08b05ca31ab5daf7ab0b1369854e62bdfb24a4cb333d1d1f0b13bea34af657e4
                                                                                                                                                                • Opcode Fuzzy Hash: e7bea6223b25fbbd7afafe02aba2063f7c18d536b268d7b1cb49c2df5d7d5825
                                                                                                                                                                • Instruction Fuzzy Hash: A8F0A732D4231DABDF20ABA4AD09EEA7BAEDB01756F0045D6EC0893300E672CD18D6D0
                                                                                                                                                                Function 006AE940 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,006AE935,?,?,006AE8FD,00000002,00000002,?), ref: 006AE955
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 006AE968
                                                                                                                                                                • FreeLibrary.KERNEL32(00000000,?,?,006AE935,?,?,006AE8FD,00000002,00000002,?), ref: 006AE98B
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                • API String ID: 4061214504-1276376045
                                                                                                                                                                • Opcode ID: 2d786124294ec6c14df04d1022a6394cd2a7135d0adfa3071a167b070c61afd6
                                                                                                                                                                • Instruction ID: 786ef95e2698a3da111da1a3b1da852dc73ed9165037e7d8947695ec61a995e5
                                                                                                                                                                • Opcode Fuzzy Hash: 2d786124294ec6c14df04d1022a6394cd2a7135d0adfa3071a167b070c61afd6
                                                                                                                                                                • Instruction Fuzzy Hash: 5AF08C30A52218FBDB11AB91DD09FEEBB7AEB01B55F010061F504A61A0CBB28E00DAA0
                                                                                                                                                                Function 00698982 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • SleepConditionVariableCS.KERNELBASE(?,0069891F,00000064), ref: 006989A5
                                                                                                                                                                • LeaveCriticalSection.KERNEL32(0071742C,00631171,?,0069891F,00000064,?,?,?,0063402B,0071827C,D8276B9A,?,00631171,?), ref: 006989AF
                                                                                                                                                                • WaitForSingleObjectEx.KERNEL32(00631171,00000000,?,0069891F,00000064,?,?,?,0063402B,0071827C,D8276B9A,?,00631171,?), ref: 006989C0
                                                                                                                                                                • EnterCriticalSection.KERNEL32(0071742C,?,0069891F,00000064,?,?,?,0063402B,0071827C,D8276B9A,?,00631171,?), ref: 006989C7
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
                                                                                                                                                                • String ID: ,tq
                                                                                                                                                                • API String ID: 3269011525-2722601934
                                                                                                                                                                • Opcode ID: ba1b41e401ecb312560d2e4518a0b97f7377ab69609e7af831fd7d8636925008
                                                                                                                                                                • Instruction ID: 10fe46b6654010b02b130d100e6f9a323cf442f6b3d663d80e7171d8b8744719
                                                                                                                                                                • Opcode Fuzzy Hash: ba1b41e401ecb312560d2e4518a0b97f7377ab69609e7af831fd7d8636925008
                                                                                                                                                                • Instruction Fuzzy Hash: D6E09B31D45164AFCB053B5CFC049DD3F3EEB097107004011FD05571A1C7660850CBD5
                                                                                                                                                                Function 006B03F2 Relevance: 7.7, APIs: 5, Instructions: 186COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 006B2174: RtlAllocateHeap.NTDLL(00000000,?,?,?,0069872D,?,?,0062A1ED,0000002C,D8276B9A), ref: 006B21A6
                                                                                                                                                                • _free.LIBCMT ref: 006B0501
                                                                                                                                                                • _free.LIBCMT ref: 006B0518
                                                                                                                                                                • _free.LIBCMT ref: 006B0535
                                                                                                                                                                • _free.LIBCMT ref: 006B0550
                                                                                                                                                                • _free.LIBCMT ref: 006B0567
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _free$AllocateHeap
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3033488037-0
                                                                                                                                                                • Opcode ID: d8e5467545b99bbccfdada152ac9040e9c31f6d46628c7b8fd039c4d0718fff0
                                                                                                                                                                • Instruction ID: ae96899f06aea15b1caf64966d4c68aefe7b177e438ca8d04ed11dd1d9a16ce3
                                                                                                                                                                • Opcode Fuzzy Hash: d8e5467545b99bbccfdada152ac9040e9c31f6d46628c7b8fd039c4d0718fff0
                                                                                                                                                                • Instruction Fuzzy Hash: BE51B0B2A00709AFEB20DF29C941AEB7BF6EF54720B14056DE506D7650E731EA81CB44
                                                                                                                                                                Function 006843F0 Relevance: 7.6, APIs: 5, Instructions: 76COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __EH_prolog3.LIBCMT ref: 006843F7
                                                                                                                                                                • std::_Lockit::_Lockit.LIBCPMT ref: 00684401
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::_Lockit.LIBCPMT ref: 00622D30
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00622D4C
                                                                                                                                                                • std::_Facet_Register.LIBCPMT ref: 00684452
                                                                                                                                                                • std::_Lockit::~_Lockit.LIBCPMT ref: 00684472
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 0068447F
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 55977855-0
                                                                                                                                                                • Opcode ID: b040bcd875af59f60c39a21a376cc4191a9aedf4ded91a9f49e737f1f011d1fa
                                                                                                                                                                • Instruction ID: 1df03efac0f0f141040dc7d680853568d4cd4a014b7a45c510d8e069ee7875ee
                                                                                                                                                                • Opcode Fuzzy Hash: b040bcd875af59f60c39a21a376cc4191a9aedf4ded91a9f49e737f1f011d1fa
                                                                                                                                                                • Instruction Fuzzy Hash: 2B11933190422A9BCB14BB989801BEEB7BBEF54710F14411EFA04AB3D1DF749A05CB98
                                                                                                                                                                Function 00687579 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Maklocstr$Maklocchr
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2020259771-0
                                                                                                                                                                • Opcode ID: 91e479a53a3fe7b2b057dfab8893e0f0902c0afa9c02d352737f33e14ef66b47
                                                                                                                                                                • Instruction ID: bb21439f668471da352aaf81c248630b3e15b537b33099a07fe2e409649fd59d
                                                                                                                                                                • Opcode Fuzzy Hash: 91e479a53a3fe7b2b057dfab8893e0f0902c0afa9c02d352737f33e14ef66b47
                                                                                                                                                                • Instruction Fuzzy Hash: A3119EB15087447FE320EBA59881F12BBEDEF08354F244A19F285CBA40E765FD5487A9
                                                                                                                                                                Function 0069459F Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __EH_prolog3.LIBCMT ref: 006945A6
                                                                                                                                                                • std::_Lockit::_Lockit.LIBCPMT ref: 006945B0
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::_Lockit.LIBCPMT ref: 00622D30
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00622D4C
                                                                                                                                                                • std::_Facet_Register.LIBCPMT ref: 00694601
                                                                                                                                                                • std::_Lockit::~_Lockit.LIBCPMT ref: 00694621
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 0069462E
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 55977855-0
                                                                                                                                                                • Opcode ID: a08eec47d798be5f6eba0a6af0338129afe25be9f99181bd2a5d3e90bcfe50da
                                                                                                                                                                • Instruction ID: 306534e5b618cca5bfe8478c52b037cda9cfc5144610d0df02e932dc44cbf260
                                                                                                                                                                • Opcode Fuzzy Hash: a08eec47d798be5f6eba0a6af0338129afe25be9f99181bd2a5d3e90bcfe50da
                                                                                                                                                                • Instruction Fuzzy Hash: 8D01AD7590022A9BCF04FBA4D851AFE777BAF44B10F24050DE410AB7D1DF749A06DB88
                                                                                                                                                                Function 00694634 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __EH_prolog3.LIBCMT ref: 0069463B
                                                                                                                                                                • std::_Lockit::_Lockit.LIBCPMT ref: 00694645
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::_Lockit.LIBCPMT ref: 00622D30
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00622D4C
                                                                                                                                                                • std::_Facet_Register.LIBCPMT ref: 00694696
                                                                                                                                                                • std::_Lockit::~_Lockit.LIBCPMT ref: 006946B6
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 006946C3
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 55977855-0
                                                                                                                                                                • Opcode ID: 4499cecff68eb78353575c9548a7c2a44054362ad8bddf0f9031ac464249c670
                                                                                                                                                                • Instruction ID: 0d7c266cfc60342883fdb4e639f14dd57739524387764afb656f88a5daca12a7
                                                                                                                                                                • Opcode Fuzzy Hash: 4499cecff68eb78353575c9548a7c2a44054362ad8bddf0f9031ac464249c670
                                                                                                                                                                • Instruction Fuzzy Hash: A701AD719041269BCF04FB64D851ABD77BBAF44710F24450EE8106B7D1CF749A05DB88
                                                                                                                                                                Function 006947F3 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __EH_prolog3.LIBCMT ref: 006947FA
                                                                                                                                                                • std::_Lockit::_Lockit.LIBCPMT ref: 00694804
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::_Lockit.LIBCPMT ref: 00622D30
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00622D4C
                                                                                                                                                                • std::_Facet_Register.LIBCPMT ref: 00694855
                                                                                                                                                                • std::_Lockit::~_Lockit.LIBCPMT ref: 00694875
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 00694882
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 55977855-0
                                                                                                                                                                • Opcode ID: 288d1c19445641729b919821cf757e9d9e7d3c42c444142069cf2b44af85414b
                                                                                                                                                                • Instruction ID: 5e893d4772f6f57ab03e2caa8cbde528459153a5f942405c1a9670542ee7b72a
                                                                                                                                                                • Opcode Fuzzy Hash: 288d1c19445641729b919821cf757e9d9e7d3c42c444142069cf2b44af85414b
                                                                                                                                                                • Instruction Fuzzy Hash: 79018B3190026A9BCF08AB64D851AAE777BAF80710F24450DE8206B781DF74DE06DB85
                                                                                                                                                                Function 00694888 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __EH_prolog3.LIBCMT ref: 0069488F
                                                                                                                                                                • std::_Lockit::_Lockit.LIBCPMT ref: 00694899
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::_Lockit.LIBCPMT ref: 00622D30
                                                                                                                                                                  • Part of subcall function 00622D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00622D4C
                                                                                                                                                                • std::_Facet_Register.LIBCPMT ref: 006948EA
                                                                                                                                                                • std::_Lockit::~_Lockit.LIBCPMT ref: 0069490A
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 00694917
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 55977855-0
                                                                                                                                                                • Opcode ID: 1664cc07f7fe35253f2939a620f9fc22dc562f706431499e74ea1272d88a36dd
                                                                                                                                                                • Instruction ID: 57ab08395c390fe5779059384be92bb647610a83162db1026d5f2849bd20d23d
                                                                                                                                                                • Opcode Fuzzy Hash: 1664cc07f7fe35253f2939a620f9fc22dc562f706431499e74ea1272d88a36dd
                                                                                                                                                                • Instruction Fuzzy Hash: E901C03190016A9BCF04FBA4D851ABE77BBAF44720F24450DE810AB7C1DF749E06DB89
                                                                                                                                                                Function 006BB487 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • _free.LIBCMT ref: 006BB49F
                                                                                                                                                                  • Part of subcall function 006B2098: RtlFreeHeap.NTDLL(00000000,00000000,?,006BB729,?,00000000,?,?,?,006BB9CC,?,00000007,?,?,006BBDD6,?), ref: 006B20AE
                                                                                                                                                                  • Part of subcall function 006B2098: GetLastError.KERNEL32(?,?,006BB729,?,00000000,?,?,?,006BB9CC,?,00000007,?,?,006BBDD6,?,?), ref: 006B20C0
                                                                                                                                                                • _free.LIBCMT ref: 006BB4B1
                                                                                                                                                                • _free.LIBCMT ref: 006BB4C3
                                                                                                                                                                • _free.LIBCMT ref: 006BB4D5
                                                                                                                                                                • _free.LIBCMT ref: 006BB4E7
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _free$ErrorFreeHeapLast
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 776569668-0
                                                                                                                                                                • Opcode ID: 42a3d645fc4a4b7cedc18b5301453ef9c46db0ed3106f03a99f5e38f43c6dba8
                                                                                                                                                                • Instruction ID: 13f4e704dc9abd29a7e7c22f29da35048f9e6d1c903f108e3ccbf3556f7d6808
                                                                                                                                                                • Opcode Fuzzy Hash: 42a3d645fc4a4b7cedc18b5301453ef9c46db0ed3106f03a99f5e38f43c6dba8
                                                                                                                                                                • Instruction Fuzzy Hash: 9AF0FFB2544604EBC674EB68F995CDA73DEFA00710794AC19F149D7A06CB64FCC08B59
                                                                                                                                                                Function 00670720 Relevance: 7.5, APIs: 2, Strings: 3, Instructions: 19COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                • c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\CabParser.h, xrefs: 00670743
                                                                                                                                                                • NWebAdvisor::CCabParser::Close, xrefs: 0067073E
                                                                                                                                                                • CloseHandle failed: %d, xrefs: 00670737
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseErrorHandleLast
                                                                                                                                                                • String ID: CloseHandle failed: %d$NWebAdvisor::CCabParser::Close$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\CabParser.h
                                                                                                                                                                • API String ID: 918212764-1823807987
                                                                                                                                                                • Opcode ID: 63657f41e818cc9abb97fd175da9e8109684875978ee355ce06a3e1c753eeb43
                                                                                                                                                                • Instruction ID: 4996c432f44e696d68920cb503ada3c43512f378467a2c12be5a967f66b92974
                                                                                                                                                                • Opcode Fuzzy Hash: 63657f41e818cc9abb97fd175da9e8109684875978ee355ce06a3e1c753eeb43
                                                                                                                                                                • Instruction Fuzzy Hash: 03D02B30782720AEF7202B29EC0AF523657DF00710F010A1DB610E61E1D5E2A8414765
                                                                                                                                                                Function 006852EC Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 317COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __EH_prolog3_GS.LIBCMT ref: 006852F3
                                                                                                                                                                  • Part of subcall function 0064BDF0: std::_Lockit::_Lockit.LIBCPMT ref: 0064BE2F
                                                                                                                                                                  • Part of subcall function 0064BDF0: std::_Lockit::_Lockit.LIBCPMT ref: 0064BE51
                                                                                                                                                                  • Part of subcall function 0064BDF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0064BE71
                                                                                                                                                                  • Part of subcall function 0064BDF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0064BFFC
                                                                                                                                                                • _Find_elem.LIBCPMT ref: 006854EF
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Lockitstd::_$Lockit::_Lockit::~_$Find_elemH_prolog3_
                                                                                                                                                                • String ID: 0123456789ABCDEFabcdef-+Xx$l8]h
                                                                                                                                                                • API String ID: 3042121994-2940359885
                                                                                                                                                                • Opcode ID: 98496517792fa1c2deb42af2c42b7a6aa5ed98ea72fa410e30ed77c72135e297
                                                                                                                                                                • Instruction ID: 551741b692f4740b5094f02921896dbe245570c57e2dae92b2e907ce1327c13d
                                                                                                                                                                • Opcode Fuzzy Hash: 98496517792fa1c2deb42af2c42b7a6aa5ed98ea72fa410e30ed77c72135e297
                                                                                                                                                                • Instruction Fuzzy Hash: 60C18F30E046988FDF25EFA4C5907ECBBB3AF55300F684259D8876B382D7609D86CB55
                                                                                                                                                                Function 006C51F0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 207COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID: \\?\
                                                                                                                                                                • API String ID: 0-4282027825
                                                                                                                                                                • Opcode ID: ffb23e56245badb408e356f372d3cc74a9cba9db2cefb878b2446f562dad8c18
                                                                                                                                                                • Instruction ID: 4d7ef6f1847a3a774cddf16a87213f8d280912937e10651b1f660e4259c4daa3
                                                                                                                                                                • Opcode Fuzzy Hash: ffb23e56245badb408e356f372d3cc74a9cba9db2cefb878b2446f562dad8c18
                                                                                                                                                                • Instruction Fuzzy Hash: BA713A71D006199BCF14DFA8CC84BAEB7BAFF45310F54062EE41AE7290E734A985CB95
                                                                                                                                                                Function 0062B420 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 184COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0062B64C
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Ios_base_dtorstd::ios_base::_
                                                                                                                                                                • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                                                                                                                                                                • API String ID: 323602529-1866435925
                                                                                                                                                                • Opcode ID: e07ea3d54543c2248044ab7ac57fb98590f6e65126c1f6cc20f4f49b1a7572f3
                                                                                                                                                                • Instruction ID: 235ad09eced480cd9865c2ed322d590bee5f3910cd41f94a1bf1ddf13a12f5ea
                                                                                                                                                                • Opcode Fuzzy Hash: e07ea3d54543c2248044ab7ac57fb98590f6e65126c1f6cc20f4f49b1a7572f3
                                                                                                                                                                • Instruction Fuzzy Hash: 25717BB1A0165ADFCB14CF58C984BA9BBF6FF08314F14816EEA149B781DB75A905CF80
                                                                                                                                                                Function 006C4620 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 159COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • WritePrivateProfileStructW.KERNEL32(?,00000000,4752434D,00000024,00000000), ref: 006C46E4
                                                                                                                                                                • GetLastError.KERNEL32 ref: 006C4728
                                                                                                                                                                • WritePrivateProfileStructW.KERNEL32(?,00000000,?,00000004,00000000), ref: 006C4768
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: PrivateProfileStructWrite$ErrorLast
                                                                                                                                                                • String ID: MCRG
                                                                                                                                                                • API String ID: 3778923442-1523812224
                                                                                                                                                                • Opcode ID: 5743136b5a9f51a10cd71da356f4d648b94957d2926e610d241ce964cf13e211
                                                                                                                                                                • Instruction ID: afe9f0c8d3d989122e614ca428b989accb1d87f0b0f48d4ad1a066bff50f94c6
                                                                                                                                                                • Opcode Fuzzy Hash: 5743136b5a9f51a10cd71da356f4d648b94957d2926e610d241ce964cf13e211
                                                                                                                                                                • Instruction Fuzzy Hash: 10519F75900249EFDB10DFA8D845FAEFBBAEF49320F148259F815AB391DB709904CB90
                                                                                                                                                                Function 00630490 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 137COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00683D98: FormatMessageA.KERNEL32(00001300,00000000,?,00000000,?,00000000,00000000,?,?,006304D5,?,?,D8276B9A), ref: 00683DAE
                                                                                                                                                                • LocalFree.KERNEL32(00000000), ref: 006305CC
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 006305F6
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Concurrency::cancel_current_taskFormatFreeLocalMessage
                                                                                                                                                                • String ID: generic$unknown error
                                                                                                                                                                • API String ID: 3868770561-3628847473
                                                                                                                                                                • Opcode ID: 26fa5a911faace6b1b9559162632d3d8ddabe74e1810969baf9c104485fd3e22
                                                                                                                                                                • Instruction ID: 166bd6870e01a32d07022940863b6fd646d76c8a0e7458f306e0689368600c56
                                                                                                                                                                • Opcode Fuzzy Hash: 26fa5a911faace6b1b9559162632d3d8ddabe74e1810969baf9c104485fd3e22
                                                                                                                                                                • Instruction Fuzzy Hash: C941D5B0900345DFEB209F68C955BAFBBFAEF44320F10062EF45697781DB7895088BA1
                                                                                                                                                                Function 006AEA12 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID: C:\Users\user\AppData\Local\Temp\is-FPJNG.tmp\prod0_extract\saBSI.exe
                                                                                                                                                                • API String ID: 0-2110676920
                                                                                                                                                                • Opcode ID: 94135f97706d0118113da04417da99c90dff05532f783dfe0b3bd7e6be66b06f
                                                                                                                                                                • Instruction ID: 1f622b11a09f2bae818acd2473fe14045eea72db855cafb1faf789a77639970b
                                                                                                                                                                • Opcode Fuzzy Hash: 94135f97706d0118113da04417da99c90dff05532f783dfe0b3bd7e6be66b06f
                                                                                                                                                                • Instruction Fuzzy Hash: C331AFB1A00218ABCB61EB999D85DDEBBFAEB8A310B14806AE50597350D6719E44CF60
                                                                                                                                                                Function 00624A4A Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 109COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: H_prolog3_
                                                                                                                                                                • String ID: /affid$MSAD_Subinfo$affid
                                                                                                                                                                • API String ID: 2427045233-3897642808
                                                                                                                                                                • Opcode ID: a09b30206ed21271d423b80a42bbd4c2dbff2eae81f64cbae903b2fc5efc6b73
                                                                                                                                                                • Instruction ID: adfa249e215ba87fb7d135f2ac2a434652e07732ad08d80cddc09a735aa6a79a
                                                                                                                                                                • Opcode Fuzzy Hash: a09b30206ed21271d423b80a42bbd4c2dbff2eae81f64cbae903b2fc5efc6b73
                                                                                                                                                                • Instruction Fuzzy Hash: 81418DB0D04218DECB08DFA4E895AEDBBB6FF09314F54406EE405AB381DB349A4ACF55
                                                                                                                                                                Function 00692F50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __EH_prolog3_GS.LIBCMT ref: 00692F57
                                                                                                                                                                  • Part of subcall function 00687DF0: __EH_prolog3.LIBCMT ref: 00687DF7
                                                                                                                                                                  • Part of subcall function 00687DF0: std::_Lockit::_Lockit.LIBCPMT ref: 00687E01
                                                                                                                                                                  • Part of subcall function 00687DF0: std::_Lockit::~_Lockit.LIBCPMT ref: 00687E72
                                                                                                                                                                • _Find_elem.LIBCPMT ref: 00692FF3
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Lockitstd::_$Find_elemH_prolog3H_prolog3_Lockit::_Lockit::~_
                                                                                                                                                                • String ID: %.0Lf$0123456789-
                                                                                                                                                                • API String ID: 2544715827-3094241602
                                                                                                                                                                • Opcode ID: 48c843c7451e8a79330bd0fbd51542da193e8d23da2375922a830647b20fc008
                                                                                                                                                                • Instruction ID: 007eae70d214ac7f4b0a142b0579b23b04a1edeb64b7f3620ce0abc501683625
                                                                                                                                                                • Opcode Fuzzy Hash: 48c843c7451e8a79330bd0fbd51542da193e8d23da2375922a830647b20fc008
                                                                                                                                                                • Instruction Fuzzy Hash: 9E417F31900219DFCF55EFA4C880AEEBBBAFF08314F10015AF811AB255DB30DA56CBA5
                                                                                                                                                                Function 00693200 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __EH_prolog3_GS.LIBCMT ref: 00693207
                                                                                                                                                                  • Part of subcall function 006232DE: __EH_prolog3_GS.LIBCMT ref: 006232E5
                                                                                                                                                                  • Part of subcall function 006232DE: std::_Lockit::_Lockit.LIBCPMT ref: 006232F2
                                                                                                                                                                  • Part of subcall function 006232DE: std::_Lockit::~_Lockit.LIBCPMT ref: 00623360
                                                                                                                                                                • _Find_elem.LIBCPMT ref: 006932A3
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: H_prolog3_Lockitstd::_$Find_elemLockit::_Lockit::~_
                                                                                                                                                                • String ID: 0123456789-$0123456789-
                                                                                                                                                                • API String ID: 3328206922-2494171821
                                                                                                                                                                • Opcode ID: ac0b5d5b6f05bbbafc2aee2ba29e45526901fd275156ca64200b782eb037f035
                                                                                                                                                                • Instruction ID: b259d4ac8acb32a28265bc6677875ff1819601bf487e209dc6f4e94f9f7d056d
                                                                                                                                                                • Opcode Fuzzy Hash: ac0b5d5b6f05bbbafc2aee2ba29e45526901fd275156ca64200b782eb037f035
                                                                                                                                                                • Instruction Fuzzy Hash: 6C414D31900228DFCF45EFA4D8859EEBBBAFF09310F1001A9E911AB255DB709A56CB95
                                                                                                                                                                Function 00697470 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __EH_prolog3_GS.LIBCMT ref: 00697477
                                                                                                                                                                  • Part of subcall function 0064C960: std::_Lockit::_Lockit.LIBCPMT ref: 0064C995
                                                                                                                                                                  • Part of subcall function 0064C960: std::_Lockit::_Lockit.LIBCPMT ref: 0064C9B7
                                                                                                                                                                  • Part of subcall function 0064C960: std::_Lockit::~_Lockit.LIBCPMT ref: 0064C9D7
                                                                                                                                                                  • Part of subcall function 0064C960: std::_Lockit::~_Lockit.LIBCPMT ref: 0064CAB1
                                                                                                                                                                • _Find_elem.LIBCPMT ref: 00697511
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Lockitstd::_$Lockit::_Lockit::~_$Find_elemH_prolog3_
                                                                                                                                                                • String ID: 0123456789-$0123456789-
                                                                                                                                                                • API String ID: 3042121994-2494171821
                                                                                                                                                                • Opcode ID: 87fc9fff0ba2dacce4a34245b712f0a734531c3d910035a5cff6bb900d100364
                                                                                                                                                                • Instruction ID: 9243367f3412852163c75a88117a4f02e42988f2010aafcf520be751da63fbd4
                                                                                                                                                                • Opcode Fuzzy Hash: 87fc9fff0ba2dacce4a34245b712f0a734531c3d910035a5cff6bb900d100364
                                                                                                                                                                • Instruction Fuzzy Hash: 65416031901219EFCF45EFA4D891AEEBBBAFF04310F50009AF911AB252DB359A16CF55
                                                                                                                                                                Function 00637156 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00644B40: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0064521E
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00637D3D
                                                                                                                                                                • __Mtx_unlock.LIBCPMT ref: 00637DC8
                                                                                                                                                                  • Part of subcall function 00629BB0: InitOnceBeginInitialize.KERNEL32(007180C4,00000000,D8276B9A,00000000,D8276B9A,0062A219,007180CC,?,?,?,?,?,?,0062A219,?,?), ref: 00629BE5
                                                                                                                                                                  • Part of subcall function 00629BB0: InitOnceComplete.KERNEL32(007180C4,00000000,00000000), ref: 00629C1D
                                                                                                                                                                  • Part of subcall function 00629940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00629A12
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Ios_base_dtorstd::ios_base::_$InitOnce$BeginCompleteInitializeMtx_unlock
                                                                                                                                                                • String ID: Failed to add event category ($V
                                                                                                                                                                • API String ID: 2287862619-1647955383
                                                                                                                                                                • Opcode ID: 27da402489c4d6d9c136f7f771ae39c66a43b348541b33096aba6323f0ba3dda
                                                                                                                                                                • Instruction ID: 63e22cc9553244c4076a0c2067d5a3648bdaaf52b56d891006deee33590dcc1f
                                                                                                                                                                • Opcode Fuzzy Hash: 27da402489c4d6d9c136f7f771ae39c66a43b348541b33096aba6323f0ba3dda
                                                                                                                                                                • Instruction Fuzzy Hash: 4231A0B0904248CFDF54EFA0D856BDD7BB6EF55304F50409DE8061B242EB79AA08CFA6
                                                                                                                                                                Function 0063A7DC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,D8276B9A,?,?), ref: 0063A531
                                                                                                                                                                • __Mtx_unlock.LIBCPMT ref: 0063A7EC
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0063A989
                                                                                                                                                                  • Part of subcall function 0063F110: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0063F268
                                                                                                                                                                Strings
                                                                                                                                                                • Unexpected return value: , xrefs: 0063A8CC
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Ios_base_dtorstd::ios_base::_$Mtx_unlockMultipleObjectsWait
                                                                                                                                                                • String ID: Unexpected return value:
                                                                                                                                                                • API String ID: 1703231451-3613193034
                                                                                                                                                                • Opcode ID: 0e9f1467bae65cb65a0694b2667e3474ea8af824c61f35acbf801ffc1b4b3053
                                                                                                                                                                • Instruction ID: f58568ce34e10a7ae99326e820a9977d675e7a41be8714ea6f4cdea48100a811
                                                                                                                                                                • Opcode Fuzzy Hash: 0e9f1467bae65cb65a0694b2667e3474ea8af824c61f35acbf801ffc1b4b3053
                                                                                                                                                                • Instruction Fuzzy Hash: 0821BF70D012189BDF14DFE4DC89AECB73BAF45324F10429CE451AB2D2DB309A85DB96
                                                                                                                                                                Function 00637052 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00629BB0: InitOnceBeginInitialize.KERNEL32(007180C4,00000000,D8276B9A,00000000,D8276B9A,0062A219,007180CC,?,?,?,?,?,?,0062A219,?,?), ref: 00629BE5
                                                                                                                                                                  • Part of subcall function 00629BB0: InitOnceComplete.KERNEL32(007180C4,00000000,00000000), ref: 00629C1D
                                                                                                                                                                  • Part of subcall function 00629940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00629A12
                                                                                                                                                                • std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00637D3D
                                                                                                                                                                • __Mtx_unlock.LIBCPMT ref: 00637DC8
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: InitIos_base_dtorOncestd::ios_base::_$BeginCompleteInitializeMtx_unlock
                                                                                                                                                                • String ID: P$Service has not been initialized
                                                                                                                                                                • API String ID: 920826028-2917841385
                                                                                                                                                                • Opcode ID: ff9183d0b72b59685c7139ade796c326742610e439b4e67d04fcc897b019494a
                                                                                                                                                                • Instruction ID: 1f096d516cd8199c83d09baace8eebe38d81d0e6cd23f8112e107483b534f7bb
                                                                                                                                                                • Opcode Fuzzy Hash: ff9183d0b72b59685c7139ade796c326742610e439b4e67d04fcc897b019494a
                                                                                                                                                                • Instruction Fuzzy Hash: CC01B17190425C8EDF44EF90E462BED7776AF54310F40406DE90217281EB75A60CCE69
                                                                                                                                                                Function 0062308E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • __EH_prolog3.LIBCMT ref: 00623095
                                                                                                                                                                • std::_Lockit::_Lockit.LIBCPMT ref: 006230A2
                                                                                                                                                                • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 006230DF
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: std::_$H_prolog3Locinfo::_Locinfo_ctorLockitLockit::_
                                                                                                                                                                • String ID: bad locale name
                                                                                                                                                                • API String ID: 4089677319-1405518554
                                                                                                                                                                • Opcode ID: 9633e448af66884b605c5ecd0bc70da4cbdd9d51d6e03aa895b62fc780c55235
                                                                                                                                                                • Instruction ID: 188590d27d62ab4b013da56d69e8a30ab18e306ec8e1df3b3275c1b88d9b5204
                                                                                                                                                                • Opcode Fuzzy Hash: 9633e448af66884b605c5ecd0bc70da4cbdd9d51d6e03aa895b62fc780c55235
                                                                                                                                                                • Instruction Fuzzy Hash: 970162B1405B94DEC7309F79848154AFEE1BF29700B508A2FE18DC7B41CB34A604CB6D
                                                                                                                                                                Function 006B24F8 Relevance: 6.3, APIs: 4, Instructions: 320COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _strrchr
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3213747228-0
                                                                                                                                                                • Opcode ID: 2052368595d85d8921707e714fa8cf7e39a0871388d90fe44b2f9a70ca8f8144
                                                                                                                                                                • Instruction ID: 7baeaebe973001451a6385cd7b08544d02f9793f31c503e836ca632ca551f2ee
                                                                                                                                                                • Opcode Fuzzy Hash: 2052368595d85d8921707e714fa8cf7e39a0871388d90fe44b2f9a70ca8f8144
                                                                                                                                                                • Instruction Fuzzy Hash: 91B138B29042879FDB15CF28C8A1BEEBBE7EF55340F2441A9D845DB341E6349D81CB64
                                                                                                                                                                Function 006C2AF0 Relevance: 6.2, APIs: 4, Instructions: 173COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 0062463F: GetProcessHeap.KERNEL32(?,?,?,0064C2E1,?,?,?,D8276B9A,?,00000000), ref: 00624676
                                                                                                                                                                • WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,00000000,00000000,00000000,00000000,?,?,?,?,?,006CFB28,000000FF), ref: 006C2BF4
                                                                                                                                                                  • Part of subcall function 006475F0: FindResourceExW.KERNEL32(00000000,00000006,00000001,00000000,?,80070057,8007000E,80004005,00648806,00000000,?,00000000,00000002,00000000), ref: 00647628
                                                                                                                                                                  • Part of subcall function 006475F0: LoadResource.KERNEL32(00000000,00000000,?,00000000,00000002,00000000), ref: 00647636
                                                                                                                                                                  • Part of subcall function 006475F0: LockResource.KERNEL32(00000000,?,00000000,00000002,00000000), ref: 00647641
                                                                                                                                                                  • Part of subcall function 006475F0: SizeofResource.KERNEL32(00000000,00000000,?,00000000,00000002,00000000), ref: 0064764F
                                                                                                                                                                • FindResourceW.KERNEL32(00000000,?,00000006), ref: 006C2B74
                                                                                                                                                                  • Part of subcall function 00647580: LoadResource.KERNEL32(80070057,8007000E,80004005,00648806,00000000,?,00000000,00000002,00000000), ref: 00647589
                                                                                                                                                                  • Part of subcall function 00647580: LockResource.KERNEL32(00000000,?,00000000,00000002,00000000), ref: 00647594
                                                                                                                                                                  • Part of subcall function 00647580: SizeofResource.KERNEL32(00000101,00000101,?,00000000,00000002,00000000), ref: 006475A8
                                                                                                                                                                • WideCharToMultiByte.KERNEL32(00000003,00000000,00000002,?,00000000,00000000,00000000,00000000,?,?,00000006), ref: 006C2BAB
                                                                                                                                                                • WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?,00000000,00000000,00000000,?,?,?,?,?,006CFB28,000000FF), ref: 006C2C2E
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Resource$ByteCharMultiWide$FindLoadLockSizeof$HeapProcess
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2838002939-0
                                                                                                                                                                • Opcode ID: 39012076884d0a5d855077101f5c9c7de9f0ad50f0810be419b77e60330e4f10
                                                                                                                                                                • Instruction ID: b53469aebcd001e765e7bce8fd585a362592a13dd309ab4e0de296712b065e70
                                                                                                                                                                • Opcode Fuzzy Hash: 39012076884d0a5d855077101f5c9c7de9f0ad50f0810be419b77e60330e4f10
                                                                                                                                                                • Instruction Fuzzy Hash: 0F51BC30200642AFE7249F18CCA9F7AB7EAEB54714F20465DFA419B3D0DBB5A800CB64
                                                                                                                                                                Function 0069C0E1 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AdjustPointer
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1740715915-0
                                                                                                                                                                • Opcode ID: 1904254c97f2d57aeea63607c8c4494cdc9fc18c340d59cc48d7238bcc1da431
                                                                                                                                                                • Instruction ID: 59799509da6679cf4aa07004957131e640c6b436e1d36920ea6aa082851237c3
                                                                                                                                                                • Opcode Fuzzy Hash: 1904254c97f2d57aeea63607c8c4494cdc9fc18c340d59cc48d7238bcc1da431
                                                                                                                                                                • Instruction Fuzzy Hash: 0C51D372604206EFEF299F98C841BBA77AEFF08724F14412EE80597A92D731ED41D794
                                                                                                                                                                Function 006B3531 Relevance: 6.1, APIs: 4, Instructions: 132COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: 694d0d9dfcc4623ba45cfc6d538bdc430f4cda997e3dc52b68a7c6b5e17a5777
                                                                                                                                                                • Instruction ID: 869340fee5d692f05dcc9064691be494dfcada30c3b2c98de2aad7f1b7473ad5
                                                                                                                                                                • Opcode Fuzzy Hash: 694d0d9dfcc4623ba45cfc6d538bdc430f4cda997e3dc52b68a7c6b5e17a5777
                                                                                                                                                                • Instruction Fuzzy Hash: 7C41BAF2B00714BFDB249F78C845BEABBABEB84710F10452DF151DB781D6719A818B94
                                                                                                                                                                Function 0064EBA0 Relevance: 6.1, APIs: 4, Instructions: 90registryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • RegSetKeySecurity.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0064EBCB
                                                                                                                                                                • RegEnumKeyExW.ADVAPI32(00000000,00000000,?,00000100,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0064EC28
                                                                                                                                                                • RegOpenKeyExW.ADVAPI32(00000000,?,00000000,000F003F,?,?,00000000,00000000), ref: 0064EC4F
                                                                                                                                                                  • Part of subcall function 0064EBA0: RegCloseKey.ADVAPI32(?,?,00000000,00000000), ref: 0064EC7E
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseEnumOpenSecurity
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 611561417-0
                                                                                                                                                                • Opcode ID: e4c27f962d81cbe3ab05e67a4722b5669e8eb496f02980c4d967db3481abe87c
                                                                                                                                                                • Instruction ID: a73ec20a0c5e9fa88f432e818ead0c6bb8b7b41c9d3c9c5ec9e5a5a69a470c4d
                                                                                                                                                                • Opcode Fuzzy Hash: e4c27f962d81cbe3ab05e67a4722b5669e8eb496f02980c4d967db3481abe87c
                                                                                                                                                                • Instruction Fuzzy Hash: 11318272A4021CAFDB20DF54DD49FEAB7B9FB18700F0045AAF915E7291DA719E50CB90
                                                                                                                                                                Function 006AE0E7 Relevance: 6.1, APIs: 4, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: f52025e15f07e9c18a94c09fd6b5b25e2dd9ad461c618c0d4b1b0391c98dd36d
                                                                                                                                                                • Instruction ID: fee00a16266dcb18e2ad17641b03eb80b1aa970e20fc4612b8681fafa353eb3e
                                                                                                                                                                • Opcode Fuzzy Hash: f52025e15f07e9c18a94c09fd6b5b25e2dd9ad461c618c0d4b1b0391c98dd36d
                                                                                                                                                                • Instruction Fuzzy Hash: F621D471644215BFEB10BF64CC81DBB77AFEF023647104929F4258B240E732DC418BA0
                                                                                                                                                                Function 006AF540 Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • _free.LIBCMT ref: 006AF549
                                                                                                                                                                  • Part of subcall function 006B2098: RtlFreeHeap.NTDLL(00000000,00000000,?,006BB729,?,00000000,?,?,?,006BB9CC,?,00000007,?,?,006BBDD6,?), ref: 006B20AE
                                                                                                                                                                  • Part of subcall function 006B2098: GetLastError.KERNEL32(?,?,006BB729,?,00000000,?,?,?,006BB9CC,?,00000007,?,?,006BBDD6,?,?), ref: 006B20C0
                                                                                                                                                                • _free.LIBCMT ref: 006AF55C
                                                                                                                                                                • _free.LIBCMT ref: 006AF56D
                                                                                                                                                                • _free.LIBCMT ref: 006AF57E
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _free$ErrorFreeHeapLast
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 776569668-0
                                                                                                                                                                • Opcode ID: 41ceba843ee3eb543219d39028e7a2d65776f8430c54a889fe0dcf2873481941
                                                                                                                                                                • Instruction ID: e5a4575230a197d9ee47763a4c72f1afbbb2eb27803e90b717c36dabc8da7831
                                                                                                                                                                • Opcode Fuzzy Hash: 41ceba843ee3eb543219d39028e7a2d65776f8430c54a889fe0dcf2873481941
                                                                                                                                                                • Instruction Fuzzy Hash: 55E04FB05486209A86A23F3CBC014D53BB6A718700344C40AF408023B2CF3E02ADDBEE
                                                                                                                                                                Function 006C4440 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 166COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 006C2AF0: FindResourceW.KERNEL32(00000000,?,00000006), ref: 006C2B74
                                                                                                                                                                  • Part of subcall function 006C2AF0: WideCharToMultiByte.KERNEL32(00000003,00000000,00000002,?,00000000,00000000,00000000,00000000,?,?,00000006), ref: 006C2BAB
                                                                                                                                                                  • Part of subcall function 006C2AF0: WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?,00000000,00000000,00000000,?,?,?,?,?,006CFB28,000000FF), ref: 006C2C2E
                                                                                                                                                                • WritePrivateProfileStructW.KERNEL32(?,00000000,4752434D,00000024,00000002), ref: 006C453C
                                                                                                                                                                • WritePrivateProfileStructW.KERNEL32(?,?,00000000,?,00000002), ref: 006C4598
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ByteCharMultiPrivateProfileStructWideWrite$FindResource
                                                                                                                                                                • String ID: MCRG
                                                                                                                                                                • API String ID: 2178413835-1523812224
                                                                                                                                                                • Opcode ID: 9e6d526fb6f1120f2c270bdb8edabbb45c158b952d3d83c08489151859d9d206
                                                                                                                                                                • Instruction ID: dab51e5cea79cadf25a9788e61bf288cef117f1ce9bf6930930b42762e16d198
                                                                                                                                                                • Opcode Fuzzy Hash: 9e6d526fb6f1120f2c270bdb8edabbb45c158b952d3d83c08489151859d9d206
                                                                                                                                                                • Instruction Fuzzy Hash: 6B616A71901148EFDB01DFA8C844FAEFBB6EF49320F148259F815AB3A1DB75A905CB90
                                                                                                                                                                Function 006471C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 157COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 00647362
                                                                                                                                                                • Concurrency::cancel_current_task.LIBCPMT ref: 00647367
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Concurrency::cancel_current_task
                                                                                                                                                                • String ID: 'md
                                                                                                                                                                • API String ID: 118556049-1489975772
                                                                                                                                                                • Opcode ID: a538514e9597ad1e0e65e765f53b90262e2e64768f85c61adc0522c1d936b898
                                                                                                                                                                • Instruction ID: e5523c021ccb4ac5639ec0502fa32eff4553e6eace968978a4f0c66fb6f96942
                                                                                                                                                                • Opcode Fuzzy Hash: a538514e9597ad1e0e65e765f53b90262e2e64768f85c61adc0522c1d936b898
                                                                                                                                                                • Instruction Fuzzy Hash: D051C1B1904605CFDB28CF68C94176FB7FAEF48310F100A2EE45A97791DB71EA448B95
                                                                                                                                                                Function 0069C6E2 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 0069C707
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: EncodePointer
                                                                                                                                                                • String ID: MOC$RCC
                                                                                                                                                                • API String ID: 2118026453-2084237596
                                                                                                                                                                • Opcode ID: 16cac4ddc99190f2b6440fb2766744eadd021ee0c812e43cb2dbc2fe2bd112e4
                                                                                                                                                                • Instruction ID: ac92ff11ab9d47a03a3f3f4ca7026155539701f4a7242ba49187b857e4110abb
                                                                                                                                                                • Opcode Fuzzy Hash: 16cac4ddc99190f2b6440fb2766744eadd021ee0c812e43cb2dbc2fe2bd112e4
                                                                                                                                                                • Instruction Fuzzy Hash: 83415971900209AFCF16DF98CD81AEEBBBABF48310F148199F914AB611D3359950DF50
                                                                                                                                                                Function 006B2E58 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _free
                                                                                                                                                                • String ID: P|q$T|q
                                                                                                                                                                • API String ID: 269201875-3867605849
                                                                                                                                                                • Opcode ID: 0807ca83a7f3bba503281dbbe6fea27de49d16b21a6b253c6446c76378649ce1
                                                                                                                                                                • Instruction ID: 7d2db0111dce670216fcaf6bd8d8da49245afa78ee0d6670477088b149c406c9
                                                                                                                                                                • Opcode Fuzzy Hash: 0807ca83a7f3bba503281dbbe6fea27de49d16b21a6b253c6446c76378649ce1
                                                                                                                                                                • Instruction Fuzzy Hash: 7511B1F15043039BD764AF2AD891AE2B7F9EB15364B20442EE089CB282E731E8C18794
                                                                                                                                                                Function 00698367 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0069904B
                                                                                                                                                                • ___raise_securityfailure.LIBCMT ref: 00699133
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FeaturePresentProcessor___raise_securityfailure
                                                                                                                                                                • String ID: Xtq
                                                                                                                                                                • API String ID: 3761405300-4055849794
                                                                                                                                                                • Opcode ID: 851a416d746b2fc681c8a36ab93f8f3d9d4d031174757403b2f15e760f45e33b
                                                                                                                                                                • Instruction ID: 27d83cdb71399b62df8f93b6eb1d7ed8aaea977ef15fa47b42d4a63e2b07549c
                                                                                                                                                                • Opcode Fuzzy Hash: 851a416d746b2fc681c8a36ab93f8f3d9d4d031174757403b2f15e760f45e33b
                                                                                                                                                                • Instruction Fuzzy Hash: 1621D2B4548240DED718CF1DFD866803BBABB08310F60D16AE9098B7F0E7B865A5CF58
                                                                                                                                                                Function 006C6290 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58registryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 006C2AF0: FindResourceW.KERNEL32(00000000,?,00000006), ref: 006C2B74
                                                                                                                                                                  • Part of subcall function 006C2AF0: WideCharToMultiByte.KERNEL32(00000003,00000000,00000002,?,00000000,00000000,00000000,00000000,?,?,00000006), ref: 006C2BAB
                                                                                                                                                                  • Part of subcall function 006C2AF0: WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?,00000000,00000000,00000000,?,?,?,?,?,006CFB28,000000FF), ref: 006C2C2E
                                                                                                                                                                • RegQueryValueExA.ADVAPI32(00000000,00000000,00000000,?,00000100,%`l,?,00000000,?,?,?,006C6025,?,00000100,00000000,00000100), ref: 006C62BB
                                                                                                                                                                • RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,00000000,%`l,00000100,00000000,00000100), ref: 006C62F9
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ByteCharMultiQueryValueWide$FindResource
                                                                                                                                                                • String ID: %`l
                                                                                                                                                                • API String ID: 3794624133-3762166733
                                                                                                                                                                • Opcode ID: abb1f48f62ebf976f3da4c00fb23a48f944de9a7155d29818f3f8625d446baf7
                                                                                                                                                                • Instruction ID: 1c522f670c6fe4ff651bc8552094b5af15cb5545a690518e01130ed0cc59e105
                                                                                                                                                                • Opcode Fuzzy Hash: abb1f48f62ebf976f3da4c00fb23a48f944de9a7155d29818f3f8625d446baf7
                                                                                                                                                                • Instruction Fuzzy Hash: 6D119131500209FFDB119F54CC45F9ABBAAFF49360F148169FC189B2A1D7729D60DB94
                                                                                                                                                                Function 0064E5E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CLSIDFromString.OLE32(0000007B,?), ref: 0064E650
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FromString
                                                                                                                                                                • String ID: @${
                                                                                                                                                                • API String ID: 1694596556-3118734784
                                                                                                                                                                • Opcode ID: 2523de01f9a6c911ae477d7fb6557192f73f59744cece3ac7c19553d5846a88b
                                                                                                                                                                • Instruction ID: dc7e025841ec4a2b65b4bb109e252b4ff5ddabae9302abe7278eeb3cbacd400d
                                                                                                                                                                • Opcode Fuzzy Hash: 2523de01f9a6c911ae477d7fb6557192f73f59744cece3ac7c19553d5846a88b
                                                                                                                                                                • Instruction Fuzzy Hash: 5D01A531A002089BCF20DF68D901BDEB3B9FF99710F41819EF84AE7110DE70AA84CB94
                                                                                                                                                                Function 00699146 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00699151
                                                                                                                                                                • ___raise_securityfailure.LIBCMT ref: 0069920E
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FeaturePresentProcessor___raise_securityfailure
                                                                                                                                                                • String ID: Xtq
                                                                                                                                                                • API String ID: 3761405300-4055849794
                                                                                                                                                                • Opcode ID: c47022c3a063a3abd1b70e4c307c3ece9ffc2aae4f7a897ab3f6700cd7c41d14
                                                                                                                                                                • Instruction ID: 882348f8847a41e30da4013c50d87513226a017153c445d22f85d7a4f2af3760
                                                                                                                                                                • Opcode Fuzzy Hash: c47022c3a063a3abd1b70e4c307c3ece9ffc2aae4f7a897ab3f6700cd7c41d14
                                                                                                                                                                • Instruction Fuzzy Hash: FB118DB89592449BD718DF1DEC816803BBABB08300B10E06AA8098B3F0E778A565CF59
                                                                                                                                                                Function 00682743 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMONLIBRARYCODE
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • DloadGetSRWLockFunctionPointers.DELAYIMP ref: 00682743
                                                                                                                                                                  • Part of subcall function 006826D0: GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,00682748,006828F1), ref: 006826E7
                                                                                                                                                                • AcquireSRWLockExclusive.KERNEL32(?,006828F1), ref: 00682760
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000000A.00000002.2896635378.0000000000611000.00000020.00000001.01000000.00000016.sdmp, Offset: 00610000, based on PE: true
                                                                                                                                                                • Associated: 0000000A.00000002.2896576573.0000000000610000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896762694.00000000006DE000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896843392.000000000070F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896905500.0000000000714000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2896966042.0000000000716000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                • Associated: 0000000A.00000002.2897035315.0000000000719000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_10_2_610000_saBSI.jbxd
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Lock$AcquireDloadExclusiveFunctionHandleModulePointers
                                                                                                                                                                • String ID: 8oq
                                                                                                                                                                • API String ID: 3692202576-274619384
                                                                                                                                                                • Opcode ID: e99cc32f9001c3996dc72fe6c28d5bbe5623d9fb64b769901b9f029d4a9545b1
                                                                                                                                                                • Instruction ID: 58cc3d9f4b9a8879e9b415aad58d5b371696fbb239b6e151b4ea43e04aa0415b
                                                                                                                                                                • Opcode Fuzzy Hash: e99cc32f9001c3996dc72fe6c28d5bbe5623d9fb64b769901b9f029d4a9545b1
                                                                                                                                                                • Instruction Fuzzy Hash: 7AE0C230335213474F147B2ABEA49EA238BAB41744701427AE702D33D0DA188CC3CB80